blob: 80be91fd3347a2736a845d0fb32a369741611962 [file] [log] [blame]
Christopher Collins92ea77f2016-12-12 15:59:26 -08001/*
David Brownaac71112020-02-03 16:13:42 -07002 * SPDX-License-Identifier: Apache-2.0
3 *
4 * Copyright (c) 2016-2020 Linaro LTD
5 * Copyright (c) 2016-2019 JUUL Labs
Antonio de Angelisba5fb1c2022-10-11 10:10:37 +01006 * Copyright (c) 2019-2023 Arm Limited
Dominik Ermel6f7f8732024-02-01 11:59:24 +00007 * Copyright (c) 2024 Nordic Semiconductor ASA
David Brownaac71112020-02-03 16:13:42 -07008 *
9 * Original license:
10 *
Christopher Collins92ea77f2016-12-12 15:59:26 -080011 * Licensed to the Apache Software Foundation (ASF) under one
12 * or more contributor license agreements. See the NOTICE file
13 * distributed with this work for additional information
14 * regarding copyright ownership. The ASF licenses this file
15 * to you under the Apache License, Version 2.0 (the
16 * "License"); you may not use this file except in compliance
17 * with the License. You may obtain a copy of the License at
18 *
19 * http://www.apache.org/licenses/LICENSE-2.0
20 *
21 * Unless required by applicable law or agreed to in writing,
22 * software distributed under the License is distributed on an
23 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
24 * KIND, either express or implied. See the License for the
25 * specific language governing permissions and limitations
26 * under the License.
27 */
28
29/**
30 * This file provides an interface to the boot loader. Functions defined in
31 * this file should only be called while the boot loader is running.
32 */
33
Christopher Collins92ea77f2016-12-12 15:59:26 -080034#include <stddef.h>
David Brown52eee562017-07-05 11:25:09 -060035#include <stdbool.h>
Christopher Collins92ea77f2016-12-12 15:59:26 -080036#include <inttypes.h>
37#include <stdlib.h>
38#include <string.h>
Christopher Collins92ea77f2016-12-12 15:59:26 -080039#include "bootutil/bootutil.h"
Kristine Jassmann73c38c62021-02-03 16:56:14 +000040#include "bootutil/bootutil_public.h"
Christopher Collins92ea77f2016-12-12 15:59:26 -080041#include "bootutil/image.h"
42#include "bootutil_priv.h"
Fabio Utzig12d59162019-11-28 10:01:59 -030043#include "swap_priv.h"
Marti Bolivarfd20c762017-02-07 16:52:50 -050044#include "bootutil/bootutil_log.h"
David Vinczec3084132020-02-18 14:50:47 +010045#include "bootutil/security_cnt.h"
David Vincze1cf11b52020-03-24 07:51:09 +010046#include "bootutil/boot_record.h"
Raef Colese8fe6cf2020-05-26 13:07:40 +010047#include "bootutil/fault_injection_hardening.h"
Mark Horvathccaf7f82021-01-04 18:16:42 +010048#include "bootutil/ramload.h"
Andrzej Puzdrowskib8f39692021-07-02 15:05:37 +020049#include "bootutil/boot_hooks.h"
Jamie McCrae56cb6102022-03-23 11:57:03 +000050#include "bootutil/mcuboot_status.h"
Marti Bolivarfd20c762017-02-07 16:52:50 -050051
Fabio Utzigba829042018-09-18 08:29:34 -030052#ifdef MCUBOOT_ENC_IMAGES
53#include "bootutil/enc_key.h"
54#endif
55
Carlos Falgueras García391b1972021-06-21 16:58:07 +020056#if !defined(MCUBOOT_DIRECT_XIP) && !defined(MCUBOOT_RAM_LOAD)
57#include <os/os_malloc.h>
58#endif
59
Fabio Utzigba1fbe62017-07-21 14:01:20 -030060#include "mcuboot_config/mcuboot_config.h"
Fabio Utzigeed80b62017-06-10 08:03:05 -030061
Carlos Falgueras Garcíaa4b4b0f2021-06-22 10:00:22 +020062BOOT_LOG_MODULE_DECLARE(mcuboot);
Emanuele Di Santo9f1933d2018-11-20 10:59:59 +010063
Marti Bolivar9b1f8bb2017-06-12 15:24:13 -040064static struct boot_loader_state boot_data;
Christopher Collins92ea77f2016-12-12 15:59:26 -080065
Fabio Utzigabec0732019-07-31 08:40:22 -030066#if (BOOT_IMAGE_NUMBER > 1)
67#define IMAGES_ITER(x) for ((x) = 0; (x) < BOOT_IMAGE_NUMBER; ++(x))
68#else
69#define IMAGES_ITER(x)
70#endif
71
Fabio Utzig10ee6482019-08-01 12:04:52 -030072/*
73 * This macro allows some control on the allocation of local variables.
74 * When running natively on a target, we don't want to allocated huge
75 * variables on the stack, so make them global instead. For the simulator
76 * we want to run as many threads as there are tests, and it's safer
77 * to just make those variables stack allocated.
78 */
79#if !defined(__BOOTSIM__)
80#define TARGET_STATIC static
81#else
82#define TARGET_STATIC
83#endif
84
Kristine Jassmann73c38c62021-02-03 16:56:14 +000085#if BOOT_MAX_ALIGN > 1024
86#define BUF_SZ BOOT_MAX_ALIGN
87#else
88#define BUF_SZ 1024
89#endif
90
Dominik Ermelaafcbad2024-02-29 20:40:20 +000091#define NO_ACTIVE_SLOT UINT32_MAX
92
David Vinczee574f2d2020-07-10 11:42:03 +020093static int
94boot_read_image_headers(struct boot_loader_state *state, bool require_all,
95 struct boot_status *bs)
96{
97 int rc;
98 int i;
99
100 for (i = 0; i < BOOT_NUM_SLOTS; i++) {
Andrzej Puzdrowskib8f39692021-07-02 15:05:37 +0200101 rc = BOOT_HOOK_CALL(boot_read_image_header_hook, BOOT_HOOK_REGULAR,
102 BOOT_CURR_IMG(state), i, boot_img_hdr(state, i));
103 if (rc == BOOT_HOOK_REGULAR)
104 {
105 rc = boot_read_image_header(state, i, boot_img_hdr(state, i), bs);
106 }
David Vinczee574f2d2020-07-10 11:42:03 +0200107 if (rc != 0) {
108 /* If `require_all` is set, fail on any single fail, otherwise
109 * if at least the first slot's header was read successfully,
110 * then the boot loader can attempt a boot.
111 *
112 * Failure to read any headers is a fatal error.
113 */
114 if (i > 0 && !require_all) {
115 return 0;
116 } else {
117 return rc;
118 }
119 }
120 }
121
122 return 0;
123}
124
Mark Horvathccaf7f82021-01-04 18:16:42 +0100125/**
126 * Saves boot status and shared data for current image.
127 *
128 * @param state Boot loader status information.
129 * @param active_slot Index of the slot will be loaded for current image.
130 *
131 * @return 0 on success; nonzero on failure.
132 */
133static int
134boot_add_shared_data(struct boot_loader_state *state,
Jamie McCrae3016d002023-03-14 12:35:51 +0000135 uint8_t active_slot)
Mark Horvathccaf7f82021-01-04 18:16:42 +0100136{
137#if defined(MCUBOOT_MEASURED_BOOT) || defined(MCUBOOT_DATA_SHARING)
138 int rc;
139
Jamie McCrae3016d002023-03-14 12:35:51 +0000140#ifdef MCUBOOT_DATA_SHARING
141 int max_app_size;
142#endif
143
Mark Horvathccaf7f82021-01-04 18:16:42 +0100144#ifdef MCUBOOT_MEASURED_BOOT
145 rc = boot_save_boot_status(BOOT_CURR_IMG(state),
146 boot_img_hdr(state, active_slot),
147 BOOT_IMG_AREA(state, active_slot));
148 if (rc != 0) {
149 BOOT_LOG_ERR("Failed to add image data to shared area");
150 return rc;
151 }
152#endif /* MCUBOOT_MEASURED_BOOT */
153
154#ifdef MCUBOOT_DATA_SHARING
Jamie McCrae3016d002023-03-14 12:35:51 +0000155 max_app_size = app_max_size(state);
Mark Horvathccaf7f82021-01-04 18:16:42 +0100156 rc = boot_save_shared_data(boot_img_hdr(state, active_slot),
Jamie McCrae3016d002023-03-14 12:35:51 +0000157 BOOT_IMG_AREA(state, active_slot),
158 active_slot, max_app_size);
Mark Horvathccaf7f82021-01-04 18:16:42 +0100159 if (rc != 0) {
160 BOOT_LOG_ERR("Failed to add data to shared memory area.");
161 return rc;
162 }
163#endif /* MCUBOOT_DATA_SHARING */
164
165 return 0;
166
167#else /* MCUBOOT_MEASURED_BOOT || MCUBOOT_DATA_SHARING */
168 (void) (state);
169 (void) (active_slot);
170
171 return 0;
172#endif
173}
174
175/**
176 * Fills rsp to indicate how booting should occur.
177 *
178 * @param state Boot loader status information.
Mark Horvathccaf7f82021-01-04 18:16:42 +0100179 * @param rsp boot_rsp struct to fill.
180 */
181static void
Raef Colesfe57e7d2021-10-15 11:07:09 +0100182fill_rsp(struct boot_loader_state *state, struct boot_rsp *rsp)
Mark Horvathccaf7f82021-01-04 18:16:42 +0100183{
184 uint32_t active_slot;
185
186#if (BOOT_IMAGE_NUMBER > 1)
Raef Colesf11de642021-10-15 11:11:56 +0100187 /* Always boot from the first enabled image. */
Mark Horvathccaf7f82021-01-04 18:16:42 +0100188 BOOT_CURR_IMG(state) = 0;
Raef Colesf11de642021-10-15 11:11:56 +0100189 IMAGES_ITER(BOOT_CURR_IMG(state)) {
190 if (!state->img_mask[BOOT_CURR_IMG(state)]) {
191 break;
192 }
193 }
INFINEON\DovhalA94360d52023-01-18 17:21:56 +0200194 /* At least one image must be active, otherwise skip the execution */
195 if (BOOT_CURR_IMG(state) >= BOOT_IMAGE_NUMBER) {
196 return;
197 }
Mark Horvathccaf7f82021-01-04 18:16:42 +0100198#endif
199
200#if defined(MCUBOOT_DIRECT_XIP) || defined(MCUBOOT_RAM_LOAD)
Raef Colesfe57e7d2021-10-15 11:07:09 +0100201 active_slot = state->slot_usage[BOOT_CURR_IMG(state)].active_slot;
Mark Horvathccaf7f82021-01-04 18:16:42 +0100202#else
Mark Horvathccaf7f82021-01-04 18:16:42 +0100203 active_slot = BOOT_PRIMARY_SLOT;
204#endif
205
Dominik Ermel260ae092021-04-23 05:38:45 +0000206 rsp->br_flash_dev_id = flash_area_get_device_id(BOOT_IMG_AREA(state, active_slot));
Mark Horvathccaf7f82021-01-04 18:16:42 +0100207 rsp->br_image_off = boot_img_slot_off(state, active_slot);
208 rsp->br_hdr = boot_img_hdr(state, active_slot);
209}
210
211/**
212 * Closes all flash areas.
213 *
214 * @param state Boot loader status information.
215 */
216static void
217close_all_flash_areas(struct boot_loader_state *state)
218{
219 uint32_t slot;
220
221 IMAGES_ITER(BOOT_CURR_IMG(state)) {
Raef Colesf11de642021-10-15 11:11:56 +0100222#if BOOT_IMAGE_NUMBER > 1
223 if (state->img_mask[BOOT_CURR_IMG(state)]) {
224 continue;
225 }
226#endif
Mark Horvathccaf7f82021-01-04 18:16:42 +0100227#if MCUBOOT_SWAP_USING_SCRATCH
228 flash_area_close(BOOT_SCRATCH_AREA(state));
229#endif
230 for (slot = 0; slot < BOOT_NUM_SLOTS; slot++) {
231 flash_area_close(BOOT_IMG_AREA(state, BOOT_NUM_SLOTS - 1 - slot));
232 }
233 }
234}
235
Dominik Ermelaafcbad2024-02-29 20:40:20 +0000236#if (BOOT_IMAGE_NUMBER > 1) || \
237 defined(MCUBOOT_DIRECT_XIP) || \
238 defined(MCUBOOT_RAM_LOAD) || \
239 defined(MCUBOOT_DOWNGRADE_PREVENTION)
240/**
241 * Compare image version numbers
242 *
243 * By default, the comparison does not take build number into account.
244 * Enable MCUBOOT_VERSION_CMP_USE_BUILD_NUMBER to take the build number into account.
245 *
246 * @param ver1 Pointer to the first image version to compare.
247 * @param ver2 Pointer to the second image version to compare.
248 *
249 * @retval -1 If ver1 is less than ver2.
250 * @retval 0 If the image version numbers are equal.
251 * @retval 1 If ver1 is greater than ver2.
252 */
253static int
254boot_version_cmp(const struct image_version *ver1,
255 const struct image_version *ver2)
256{
257 if (ver1->iv_major > ver2->iv_major) {
258 return 1;
259 }
260 if (ver1->iv_major < ver2->iv_major) {
261 return -1;
262 }
263 /* The major version numbers are equal, continue comparison. */
264 if (ver1->iv_minor > ver2->iv_minor) {
265 return 1;
266 }
267 if (ver1->iv_minor < ver2->iv_minor) {
268 return -1;
269 }
270 /* The minor version numbers are equal, continue comparison. */
271 if (ver1->iv_revision > ver2->iv_revision) {
272 return 1;
273 }
274 if (ver1->iv_revision < ver2->iv_revision) {
275 return -1;
276 }
277
278#if defined(MCUBOOT_VERSION_CMP_USE_BUILD_NUMBER)
279 /* The revisions are equal, continue comparison. */
280 if (ver1->iv_build_num > ver2->iv_build_num) {
281 return 1;
282 }
283 if (ver1->iv_build_num < ver2->iv_build_num) {
284 return -1;
285 }
286#endif
287
288 return 0;
289}
290#endif
291
292
293#if (BOOT_IMAGE_NUMBER > 1)
294
295static int
296boot_verify_slot_dependencies(struct boot_loader_state *state, uint32_t slot);
297
298/**
299 * Check the image dependency whether it is satisfied and modify
300 * the swap type if necessary.
301 *
302 * @param dep Image dependency which has to be verified.
303 *
304 * @return 0 on success; nonzero on failure.
305 */
306static int
307boot_verify_slot_dependency(struct boot_loader_state *state,
308 struct image_dependency *dep)
309{
310 struct image_version *dep_version;
311 size_t dep_slot;
312 int rc;
313
314 /* Determine the source of the image which is the subject of
315 * the dependency and get it's version. */
316#if !defined(MCUBOOT_DIRECT_XIP) && !defined(MCUBOOT_RAM_LOAD)
317 uint8_t swap_type = state->swap_type[dep->image_id];
318 dep_slot = BOOT_IS_UPGRADE(swap_type) ? BOOT_SECONDARY_SLOT
319 : BOOT_PRIMARY_SLOT;
320#else
321 dep_slot = state->slot_usage[dep->image_id].active_slot;
322#endif
323
324 dep_version = &state->imgs[dep->image_id][dep_slot].hdr.ih_ver;
325
326 rc = boot_version_cmp(dep_version, &dep->image_min_version);
327#if !defined(MCUBOOT_DIRECT_XIP) && !defined(MCUBOOT_RAM_LOAD)
328 if (rc < 0) {
329 /* Dependency not satisfied.
330 * Modify the swap type to decrease the version number of the image
331 * (which will be located in the primary slot after the boot process),
332 * consequently the number of unsatisfied dependencies will be
333 * decreased or remain the same.
334 */
335 switch (BOOT_SWAP_TYPE(state)) {
336 case BOOT_SWAP_TYPE_TEST:
337 case BOOT_SWAP_TYPE_PERM:
338 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_NONE;
339 break;
340 case BOOT_SWAP_TYPE_NONE:
341 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_REVERT;
342 break;
343 default:
344 break;
345 }
346 } else {
347 /* Dependency satisfied. */
348 rc = 0;
349 }
350#else
351 if (rc >= 0) {
352 /* Dependency satisfied. */
353 rc = 0;
354 }
355#endif
356
357 return rc;
358}
359
360#if !defined(MCUBOOT_DIRECT_XIP) && !defined(MCUBOOT_RAM_LOAD)
361/**
362 * Iterate over all the images and verify whether the image dependencies in the
363 * TLV area are all satisfied and update the related swap type if necessary.
364 */
365static int
366boot_verify_dependencies(struct boot_loader_state *state)
367{
368 int rc = -1;
369 uint8_t slot;
370
371 BOOT_CURR_IMG(state) = 0;
372 while (BOOT_CURR_IMG(state) < BOOT_IMAGE_NUMBER) {
373 if (state->img_mask[BOOT_CURR_IMG(state)]) {
374 BOOT_CURR_IMG(state)++;
375 continue;
376 }
377 if (BOOT_SWAP_TYPE(state) != BOOT_SWAP_TYPE_NONE &&
378 BOOT_SWAP_TYPE(state) != BOOT_SWAP_TYPE_FAIL) {
379 slot = BOOT_SECONDARY_SLOT;
380 } else {
381 slot = BOOT_PRIMARY_SLOT;
382 }
383
384 rc = boot_verify_slot_dependencies(state, slot);
385 if (rc == 0) {
386 /* All dependencies've been satisfied, continue with next image. */
387 BOOT_CURR_IMG(state)++;
388 } else {
389 /* Cannot upgrade due to non-met dependencies, so disable all
390 * image upgrades.
391 */
392 for (int idx = 0; idx < BOOT_IMAGE_NUMBER; idx++) {
393 BOOT_CURR_IMG(state) = idx;
394 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_NONE;
395 }
396 break;
397 }
398 }
399 return rc;
400}
401#else
402
403#if defined MCUBOOT_RAM_LOAD
404static inline int
405boot_remove_image_from_sram(struct boot_loader_state *state);
406#endif
407
408/**
409 * Checks the dependency of all the active slots. If an image found with
410 * invalid or not satisfied dependencies the image is removed from SRAM (in
411 * case of MCUBOOT_RAM_LOAD strategy) and its slot is set to unavailable.
412 *
413 * @param state Boot loader status information.
414 *
415 * @return 0 if dependencies are met; nonzero otherwise.
416 */
417static int
418boot_verify_dependencies(struct boot_loader_state *state)
419{
420 int rc = -1;
421 uint32_t active_slot;
422
423 IMAGES_ITER(BOOT_CURR_IMG(state)) {
424 if (state->img_mask[BOOT_CURR_IMG(state)]) {
425 continue;
426 }
427 active_slot = state->slot_usage[BOOT_CURR_IMG(state)].active_slot;
428 rc = boot_verify_slot_dependencies(state, active_slot);
429 if (rc != 0) {
430 /* Dependencies not met or invalid dependencies. */
431
432#ifdef MCUBOOT_RAM_LOAD
433 boot_remove_image_from_sram(state);
434#endif /* MCUBOOT_RAM_LOAD */
435
436 state->slot_usage[BOOT_CURR_IMG(state)].slot_available[active_slot] = false;
437 state->slot_usage[BOOT_CURR_IMG(state)].active_slot = NO_ACTIVE_SLOT;
438
439 return rc;
440 }
441 }
442
443 return rc;
444}
445#endif
446
447/**
448 * Read all dependency TLVs of an image from the flash and verify
449 * one after another to see if they are all satisfied.
450 *
451 * @param slot Image slot number.
452 *
453 * @return 0 on success; nonzero on failure.
454 */
455static int
456boot_verify_slot_dependencies(struct boot_loader_state *state, uint32_t slot)
457{
458 const struct flash_area *fap;
459 struct image_tlv_iter it;
460 struct image_dependency dep;
461 uint32_t off;
462 uint16_t len;
463 int area_id;
464 int rc;
465
466 area_id = flash_area_id_from_multi_image_slot(BOOT_CURR_IMG(state), slot);
467 rc = flash_area_open(area_id, &fap);
468 if (rc != 0) {
469 rc = BOOT_EFLASH;
470 goto done;
471 }
472
473 rc = bootutil_tlv_iter_begin(&it, boot_img_hdr(state, slot), fap,
474 IMAGE_TLV_DEPENDENCY, true);
475 if (rc != 0) {
476 goto done;
477 }
478
479 while (true) {
480 rc = bootutil_tlv_iter_next(&it, &off, &len, NULL);
481 if (rc < 0) {
482 return -1;
483 } else if (rc > 0) {
484 rc = 0;
485 break;
486 }
487
488 if (len != sizeof(dep)) {
489 rc = BOOT_EBADIMAGE;
490 goto done;
491 }
492
493 rc = LOAD_IMAGE_DATA(boot_img_hdr(state, slot),
494 fap, off, &dep, len);
495 if (rc != 0) {
496 rc = BOOT_EFLASH;
497 goto done;
498 }
499
500 if (dep.image_id >= BOOT_IMAGE_NUMBER) {
501 rc = BOOT_EBADARGS;
502 goto done;
503 }
504
505 /* Verify dependency and modify the swap type if not satisfied. */
506 rc = boot_verify_slot_dependency(state, &dep);
507 if (rc != 0) {
508 /* Dependency not satisfied */
509 goto done;
510 }
511 }
512
513done:
514 flash_area_close(fap);
515 return rc;
516}
517
518#endif /* (BOOT_IMAGE_NUMBER > 1) */
519
Tamas Banfe031092020-09-10 17:32:39 +0200520#if !defined(MCUBOOT_DIRECT_XIP)
David Brownf5b33d82017-09-01 10:58:27 -0600521/*
522 * Compute the total size of the given image. Includes the size of
523 * the TLVs.
524 */
Tamas Banfe031092020-09-10 17:32:39 +0200525#if !defined(MCUBOOT_OVERWRITE_ONLY) || defined(MCUBOOT_OVERWRITE_ONLY_FAST)
David Brownf5b33d82017-09-01 10:58:27 -0600526static int
Fabio Utzigd638b172019-08-09 10:38:05 -0300527boot_read_image_size(struct boot_loader_state *state, int slot, uint32_t *size)
David Brownf5b33d82017-09-01 10:58:27 -0600528{
529 const struct flash_area *fap;
Fabio Utzig61fd8882019-09-14 20:00:20 -0300530 struct image_tlv_info info;
Fabio Utzig233af7d2019-08-26 12:06:16 -0300531 uint32_t off;
Fabio Utzige52c08e2019-09-11 19:32:00 -0300532 uint32_t protect_tlv_size;
David Brownf5b33d82017-09-01 10:58:27 -0600533 int area_id;
534 int rc;
535
Fabio Utzig10ee6482019-08-01 12:04:52 -0300536#if (BOOT_IMAGE_NUMBER == 1)
537 (void)state;
538#endif
539
540 area_id = flash_area_id_from_multi_image_slot(BOOT_CURR_IMG(state), slot);
David Brownf5b33d82017-09-01 10:58:27 -0600541 rc = flash_area_open(area_id, &fap);
542 if (rc != 0) {
543 rc = BOOT_EFLASH;
544 goto done;
545 }
546
Fabio Utzig61fd8882019-09-14 20:00:20 -0300547 off = BOOT_TLV_OFF(boot_img_hdr(state, slot));
548
549 if (flash_area_read(fap, off, &info, sizeof(info))) {
550 rc = BOOT_EFLASH;
David Brownf5b33d82017-09-01 10:58:27 -0600551 goto done;
552 }
Fabio Utzig61fd8882019-09-14 20:00:20 -0300553
Fabio Utzige52c08e2019-09-11 19:32:00 -0300554 protect_tlv_size = boot_img_hdr(state, slot)->ih_protect_tlv_size;
555 if (info.it_magic == IMAGE_TLV_PROT_INFO_MAGIC) {
556 if (protect_tlv_size != info.it_tlv_tot) {
557 rc = BOOT_EBADIMAGE;
558 goto done;
559 }
560
561 if (flash_area_read(fap, off + info.it_tlv_tot, &info, sizeof(info))) {
562 rc = BOOT_EFLASH;
563 goto done;
564 }
565 } else if (protect_tlv_size != 0) {
566 rc = BOOT_EBADIMAGE;
567 goto done;
568 }
569
Fabio Utzig61fd8882019-09-14 20:00:20 -0300570 if (info.it_magic != IMAGE_TLV_INFO_MAGIC) {
571 rc = BOOT_EBADIMAGE;
572 goto done;
573 }
574
Fabio Utzige52c08e2019-09-11 19:32:00 -0300575 *size = off + protect_tlv_size + info.it_tlv_tot;
David Brownf5b33d82017-09-01 10:58:27 -0600576 rc = 0;
577
578done:
579 flash_area_close(fap);
Fabio Utzig2eebf112017-09-04 15:25:08 -0300580 return rc;
David Brownf5b33d82017-09-01 10:58:27 -0600581}
Fabio Utzig36ec0e72017-09-05 08:10:33 -0300582#endif /* !MCUBOOT_OVERWRITE_ONLY */
David Brownf5b33d82017-09-01 10:58:27 -0600583
Tamas Banfe031092020-09-10 17:32:39 +0200584#if !defined(MCUBOOT_RAM_LOAD)
David Brownab449182019-11-15 09:32:52 -0700585static uint32_t
Fabio Utzig10ee6482019-08-01 12:04:52 -0300586boot_write_sz(struct boot_loader_state *state)
Christopher Collins92ea77f2016-12-12 15:59:26 -0800587{
David Brownab449182019-11-15 09:32:52 -0700588 uint32_t elem_sz;
Fabio Utzig12d59162019-11-28 10:01:59 -0300589#if MCUBOOT_SWAP_USING_SCRATCH
David Brownab449182019-11-15 09:32:52 -0700590 uint32_t align;
Fabio Utzig12d59162019-11-28 10:01:59 -0300591#endif
Christopher Collins92ea77f2016-12-12 15:59:26 -0800592
593 /* Figure out what size to write update status update as. The size depends
594 * on what the minimum write size is for scratch area, active image slot.
595 * We need to use the bigger of those 2 values.
596 */
Fabio Utzig10ee6482019-08-01 12:04:52 -0300597 elem_sz = flash_area_align(BOOT_IMG_AREA(state, BOOT_PRIMARY_SLOT));
Fabio Utzig12d59162019-11-28 10:01:59 -0300598#if MCUBOOT_SWAP_USING_SCRATCH
Fabio Utzig10ee6482019-08-01 12:04:52 -0300599 align = flash_area_align(BOOT_SCRATCH_AREA(state));
Christopher Collins92ea77f2016-12-12 15:59:26 -0800600 if (align > elem_sz) {
601 elem_sz = align;
602 }
Fabio Utzig12d59162019-11-28 10:01:59 -0300603#endif
Christopher Collins92ea77f2016-12-12 15:59:26 -0800604
605 return elem_sz;
606}
607
Fabio Utzig10ee6482019-08-01 12:04:52 -0300608static int
609boot_initialize_area(struct boot_loader_state *state, int flash_area)
610{
Dominik Ermel51c8d762021-05-24 15:34:01 +0000611 uint32_t num_sectors = BOOT_MAX_IMG_SECTORS;
612 boot_sector_t *out_sectors;
613 uint32_t *out_num_sectors;
Fabio Utzig10ee6482019-08-01 12:04:52 -0300614 int rc;
615
616 num_sectors = BOOT_MAX_IMG_SECTORS;
617
618 if (flash_area == FLASH_AREA_IMAGE_PRIMARY(BOOT_CURR_IMG(state))) {
619 out_sectors = BOOT_IMG(state, BOOT_PRIMARY_SLOT).sectors;
620 out_num_sectors = &BOOT_IMG(state, BOOT_PRIMARY_SLOT).num_sectors;
621 } else if (flash_area == FLASH_AREA_IMAGE_SECONDARY(BOOT_CURR_IMG(state))) {
622 out_sectors = BOOT_IMG(state, BOOT_SECONDARY_SLOT).sectors;
623 out_num_sectors = &BOOT_IMG(state, BOOT_SECONDARY_SLOT).num_sectors;
Fabio Utzig12d59162019-11-28 10:01:59 -0300624#if MCUBOOT_SWAP_USING_SCRATCH
Fabio Utzig10ee6482019-08-01 12:04:52 -0300625 } else if (flash_area == FLASH_AREA_IMAGE_SCRATCH) {
626 out_sectors = state->scratch.sectors;
627 out_num_sectors = &state->scratch.num_sectors;
Fabio Utzig12d59162019-11-28 10:01:59 -0300628#endif
Fabio Utzig10ee6482019-08-01 12:04:52 -0300629 } else {
630 return BOOT_EFLASH;
631 }
632
Dominik Ermel51c8d762021-05-24 15:34:01 +0000633#ifdef MCUBOOT_USE_FLASH_AREA_GET_SECTORS
Fabio Utzig10ee6482019-08-01 12:04:52 -0300634 rc = flash_area_get_sectors(flash_area, &num_sectors, out_sectors);
Dominik Ermel51c8d762021-05-24 15:34:01 +0000635#else
636 _Static_assert(sizeof(int) <= sizeof(uint32_t), "Fix needed");
637 rc = flash_area_to_sectors(flash_area, (int *)&num_sectors, out_sectors);
638#endif /* defined(MCUBOOT_USE_FLASH_AREA_GET_SECTORS) */
Fabio Utzig10ee6482019-08-01 12:04:52 -0300639 if (rc != 0) {
640 return rc;
641 }
642 *out_num_sectors = num_sectors;
643 return 0;
644}
Fabio Utzig10ee6482019-08-01 12:04:52 -0300645
Christopher Collins92ea77f2016-12-12 15:59:26 -0800646/**
647 * Determines the sector layout of both image slots and the scratch area.
648 * This information is necessary for calculating the number of bytes to erase
649 * and copy during an image swap. The information collected during this
Fabio Utzig10ee6482019-08-01 12:04:52 -0300650 * function is used to populate the state.
Christopher Collins92ea77f2016-12-12 15:59:26 -0800651 */
652static int
Fabio Utzig10ee6482019-08-01 12:04:52 -0300653boot_read_sectors(struct boot_loader_state *state)
Christopher Collins92ea77f2016-12-12 15:59:26 -0800654{
Fabio Utzigb0f04732019-07-31 09:49:19 -0300655 uint8_t image_index;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800656 int rc;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800657
Fabio Utzig10ee6482019-08-01 12:04:52 -0300658 image_index = BOOT_CURR_IMG(state);
Fabio Utzigb0f04732019-07-31 09:49:19 -0300659
660 rc = boot_initialize_area(state, FLASH_AREA_IMAGE_PRIMARY(image_index));
Christopher Collins92ea77f2016-12-12 15:59:26 -0800661 if (rc != 0) {
662 return BOOT_EFLASH;
663 }
664
Fabio Utzig10ee6482019-08-01 12:04:52 -0300665 rc = boot_initialize_area(state, FLASH_AREA_IMAGE_SECONDARY(image_index));
Christopher Collins92ea77f2016-12-12 15:59:26 -0800666 if (rc != 0) {
Andrzej Puzdrowski54b4ad92021-06-22 13:21:22 +0200667 /* We need to differentiate from the primary image issue */
668 return BOOT_EFLASH_SEC;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800669 }
670
Fabio Utzig12d59162019-11-28 10:01:59 -0300671#if MCUBOOT_SWAP_USING_SCRATCH
Fabio Utzig10ee6482019-08-01 12:04:52 -0300672 rc = boot_initialize_area(state, FLASH_AREA_IMAGE_SCRATCH);
Fabio Utzig2bd980a2018-11-26 10:38:17 -0200673 if (rc != 0) {
674 return BOOT_EFLASH;
675 }
Fabio Utzig12d59162019-11-28 10:01:59 -0300676#endif
Fabio Utzig2bd980a2018-11-26 10:38:17 -0200677
Fabio Utzig10ee6482019-08-01 12:04:52 -0300678 BOOT_WRITE_SZ(state) = boot_write_sz(state);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800679
680 return 0;
681}
682
Fabio Utzig12d59162019-11-28 10:01:59 -0300683void
684boot_status_reset(struct boot_status *bs)
Christopher Collins92ea77f2016-12-12 15:59:26 -0800685{
Fabio Utzig4741c452019-12-19 15:32:41 -0300686#ifdef MCUBOOT_ENC_IMAGES
Kristine Jassmann73c38c62021-02-03 16:56:14 +0000687 memset(&bs->enckey, 0xff, BOOT_NUM_SLOTS * BOOT_ENC_KEY_ALIGN_SIZE);
Fabio Utzig4741c452019-12-19 15:32:41 -0300688#if MCUBOOT_SWAP_SAVE_ENCTLV
689 memset(&bs->enctlv, 0xff, BOOT_NUM_SLOTS * BOOT_ENC_TLV_ALIGN_SIZE);
690#endif
691#endif /* MCUBOOT_ENC_IMAGES */
692
693 bs->use_scratch = 0;
694 bs->swap_size = 0;
695 bs->source = 0;
696
Fabio Utzig74aef312019-11-28 11:05:34 -0300697 bs->op = BOOT_STATUS_OP_MOVE;
Fabio Utzig39000012018-07-30 12:40:20 -0300698 bs->idx = BOOT_STATUS_IDX_0;
699 bs->state = BOOT_STATUS_STATE_0;
Christopher Collinsa1c12042019-05-23 14:00:28 -0700700 bs->swap_type = BOOT_SWAP_TYPE_NONE;
Fabio Utzig12d59162019-11-28 10:01:59 -0300701}
Christopher Collins92ea77f2016-12-12 15:59:26 -0800702
Fabio Utzig12d59162019-11-28 10:01:59 -0300703bool
704boot_status_is_reset(const struct boot_status *bs)
705{
Fabio Utzig74aef312019-11-28 11:05:34 -0300706 return (bs->op == BOOT_STATUS_OP_MOVE &&
707 bs->idx == BOOT_STATUS_IDX_0 &&
708 bs->state == BOOT_STATUS_STATE_0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800709}
710
711/**
712 * Writes the supplied boot status to the flash file system. The boot status
713 * contains the current state of an in-progress image copy operation.
714 *
715 * @param bs The boot status to write.
716 *
717 * @return 0 on success; nonzero on failure.
718 */
719int
Fabio Utzig12d59162019-11-28 10:01:59 -0300720boot_write_status(const struct boot_loader_state *state, struct boot_status *bs)
Christopher Collins92ea77f2016-12-12 15:59:26 -0800721{
722 const struct flash_area *fap;
723 uint32_t off;
724 int area_id;
Dominik Ermel9479af02021-10-19 10:06:44 +0000725 int rc = 0;
Fabio Utziga0bc9b52017-06-28 09:19:55 -0300726 uint8_t buf[BOOT_MAX_ALIGN];
Gustavo Henrique Nihei4aa286d2021-11-24 14:54:56 -0300727 uint32_t align;
Fabio Utzig39000012018-07-30 12:40:20 -0300728 uint8_t erased_val;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800729
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300730 /* NOTE: The first sector copied (that is the last sector on slot) contains
David Vincze2d736ad2019-02-18 11:50:22 +0100731 * the trailer. Since in the last step the primary slot is erased, the
732 * first two status writes go to the scratch which will be copied to
733 * the primary slot!
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300734 */
735
Fabio Utzig12d59162019-11-28 10:01:59 -0300736#if MCUBOOT_SWAP_USING_SCRATCH
Fabio Utzig2473ac02017-05-02 12:45:02 -0300737 if (bs->use_scratch) {
Christopher Collins92ea77f2016-12-12 15:59:26 -0800738 /* Write to scratch. */
739 area_id = FLASH_AREA_IMAGE_SCRATCH;
740 } else {
Fabio Utzig12d59162019-11-28 10:01:59 -0300741#endif
David Vincze2d736ad2019-02-18 11:50:22 +0100742 /* Write to the primary slot. */
Fabio Utzig10ee6482019-08-01 12:04:52 -0300743 area_id = FLASH_AREA_IMAGE_PRIMARY(BOOT_CURR_IMG(state));
Fabio Utzig12d59162019-11-28 10:01:59 -0300744#if MCUBOOT_SWAP_USING_SCRATCH
Christopher Collins92ea77f2016-12-12 15:59:26 -0800745 }
Fabio Utzig12d59162019-11-28 10:01:59 -0300746#endif
Christopher Collins92ea77f2016-12-12 15:59:26 -0800747
748 rc = flash_area_open(area_id, &fap);
749 if (rc != 0) {
Dominik Ermel9479af02021-10-19 10:06:44 +0000750 return BOOT_EFLASH;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800751 }
752
753 off = boot_status_off(fap) +
Fabio Utzig12d59162019-11-28 10:01:59 -0300754 boot_status_internal_off(bs, BOOT_WRITE_SZ(state));
Andrzej Puzdrowskib788c712018-04-12 12:42:49 +0200755 align = flash_area_align(fap);
Fabio Utzig39000012018-07-30 12:40:20 -0300756 erased_val = flash_area_erased_val(fap);
757 memset(buf, erased_val, BOOT_MAX_ALIGN);
David Brown9d725462017-01-23 15:50:58 -0700758 buf[0] = bs->state;
759
Jamie McCrae35e99312024-01-03 07:37:55 +0000760 BOOT_LOG_DBG("writing swap status; fa_id=%d off=0x%lx (0x%lx)",
761 flash_area_get_id(fap), (unsigned long)off,
762 (unsigned long)flash_area_get_off(fap) + off);
763
David Brown9d725462017-01-23 15:50:58 -0700764 rc = flash_area_write(fap, off, buf, align);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800765 if (rc != 0) {
766 rc = BOOT_EFLASH;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800767 }
768
Christopher Collins92ea77f2016-12-12 15:59:26 -0800769 flash_area_close(fap);
Dominik Ermel9479af02021-10-19 10:06:44 +0000770
Christopher Collins92ea77f2016-12-12 15:59:26 -0800771 return rc;
772}
Tamas Banfe031092020-09-10 17:32:39 +0200773#endif /* !MCUBOOT_RAM_LOAD */
David Vinczee574f2d2020-07-10 11:42:03 +0200774#endif /* !MCUBOOT_DIRECT_XIP */
Christopher Collins92ea77f2016-12-12 15:59:26 -0800775
776/*
David Vinczec3084132020-02-18 14:50:47 +0100777 * Validate image hash/signature and optionally the security counter in a slot.
Christopher Collins92ea77f2016-12-12 15:59:26 -0800778 */
Michael Grand5047f032022-11-24 16:49:56 +0100779static fih_ret
Fabio Utzig10ee6482019-08-01 12:04:52 -0300780boot_image_check(struct boot_loader_state *state, struct image_header *hdr,
781 const struct flash_area *fap, struct boot_status *bs)
Christopher Collins92ea77f2016-12-12 15:59:26 -0800782{
Fabio Utzig10ee6482019-08-01 12:04:52 -0300783 TARGET_STATIC uint8_t tmpbuf[BOOT_TMPBUF_SZ];
Fabio Utzigba829042018-09-18 08:29:34 -0300784 int rc;
Michael Grand5047f032022-11-24 16:49:56 +0100785 FIH_DECLARE(fih_rc, FIH_FAILURE);
Fabio Utzigba829042018-09-18 08:29:34 -0300786
Fabio Utzig10ee6482019-08-01 12:04:52 -0300787#if (BOOT_IMAGE_NUMBER == 1)
788 (void)state;
789#endif
790
Fabio Utzigba829042018-09-18 08:29:34 -0300791 (void)bs;
792 (void)rc;
Fabio Utzigbc077932019-08-26 11:16:34 -0300793
Hugo L'Hostisdb543e52021-03-09 18:00:31 +0000794/* In the case of ram loading the image has already been decrypted as it is
795 * decrypted when copied in ram */
796#if defined(MCUBOOT_ENC_IMAGES) && !defined(MCUBOOT_RAM_LOAD)
Dominik Ermel7f9ac972024-07-12 19:21:40 +0000797 if (MUST_DECRYPT(fap, BOOT_CURR_IMG(state), hdr)) {
798 rc = boot_enc_load(BOOT_CURR_ENC(state), 1, hdr, fap, bs);
Fabio Utzigba829042018-09-18 08:29:34 -0300799 if (rc < 0) {
Raef Colese8fe6cf2020-05-26 13:07:40 +0100800 FIH_RET(fih_rc);
Fabio Utzigba829042018-09-18 08:29:34 -0300801 }
Fabio Utzig4741c452019-12-19 15:32:41 -0300802 if (rc == 0 && boot_enc_set_key(BOOT_CURR_ENC(state), 1, bs)) {
Raef Colese8fe6cf2020-05-26 13:07:40 +0100803 FIH_RET(fih_rc);
Fabio Utzigba829042018-09-18 08:29:34 -0300804 }
805 }
Fabio Utzigbc077932019-08-26 11:16:34 -0300806#endif
807
Dominik Ermel7f9ac972024-07-12 19:21:40 +0000808 FIH_CALL(bootutil_img_validate, fih_rc, BOOT_CURR_ENC(state),
809 BOOT_CURR_IMG(state), hdr, fap, tmpbuf, BOOT_TMPBUF_SZ,
810 NULL, 0, NULL);
Fabio Utzig10ee6482019-08-01 12:04:52 -0300811
Raef Colese8fe6cf2020-05-26 13:07:40 +0100812 FIH_RET(fih_rc);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800813}
814
Tamas Banfe031092020-09-10 17:32:39 +0200815#if !defined(MCUBOOT_DIRECT_XIP) && !defined(MCUBOOT_RAM_LOAD)
Michael Grand5047f032022-11-24 16:49:56 +0100816static fih_ret
Christopher Collins92ea77f2016-12-12 15:59:26 -0800817split_image_check(struct image_header *app_hdr,
818 const struct flash_area *app_fap,
819 struct image_header *loader_hdr,
820 const struct flash_area *loader_fap)
821{
822 static void *tmpbuf;
823 uint8_t loader_hash[32];
Michael Grand5047f032022-11-24 16:49:56 +0100824 FIH_DECLARE(fih_rc, FIH_FAILURE);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800825
826 if (!tmpbuf) {
827 tmpbuf = malloc(BOOT_TMPBUF_SZ);
828 if (!tmpbuf) {
Raef Colese8fe6cf2020-05-26 13:07:40 +0100829 goto out;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800830 }
831 }
832
Raef Colese8fe6cf2020-05-26 13:07:40 +0100833 FIH_CALL(bootutil_img_validate, fih_rc, NULL, 0, loader_hdr, loader_fap,
834 tmpbuf, BOOT_TMPBUF_SZ, NULL, 0, loader_hash);
Michael Grand5047f032022-11-24 16:49:56 +0100835 if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
Raef Colese8fe6cf2020-05-26 13:07:40 +0100836 FIH_RET(fih_rc);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800837 }
838
Raef Colese8fe6cf2020-05-26 13:07:40 +0100839 FIH_CALL(bootutil_img_validate, fih_rc, NULL, 0, app_hdr, app_fap,
840 tmpbuf, BOOT_TMPBUF_SZ, loader_hash, 32, NULL);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800841
Raef Colese8fe6cf2020-05-26 13:07:40 +0100842out:
843 FIH_RET(fih_rc);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800844}
Tamas Banfe031092020-09-10 17:32:39 +0200845#endif /* !MCUBOOT_DIRECT_XIP && !MCUBOOT_RAM_LOAD */
Christopher Collins92ea77f2016-12-12 15:59:26 -0800846
Fabio Utzig338a19f2018-12-03 08:37:08 -0200847/*
David Brown9bf95af2019-10-10 15:36:36 -0600848 * Check that this is a valid header. Valid means that the magic is
849 * correct, and that the sizes/offsets are "sane". Sane means that
850 * there is no overflow on the arithmetic, and that the result fits
851 * within the flash area we are in.
852 */
853static bool
854boot_is_header_valid(const struct image_header *hdr, const struct flash_area *fap)
855{
856 uint32_t size;
857
858 if (hdr->ih_magic != IMAGE_MAGIC) {
859 return false;
860 }
861
862 if (!boot_u32_safe_add(&size, hdr->ih_img_size, hdr->ih_hdr_size)) {
863 return false;
864 }
865
Dominik Ermel260ae092021-04-23 05:38:45 +0000866 if (size >= flash_area_get_size(fap)) {
David Brown9bf95af2019-10-10 15:36:36 -0600867 return false;
868 }
869
870 return true;
871}
872
873/*
Fabio Utzig338a19f2018-12-03 08:37:08 -0200874 * Check that a memory area consists of a given value.
875 */
876static inline bool
877boot_data_is_set_to(uint8_t val, void *data, size_t len)
Fabio Utzig39000012018-07-30 12:40:20 -0300878{
879 uint8_t i;
Fabio Utzig338a19f2018-12-03 08:37:08 -0200880 uint8_t *p = (uint8_t *)data;
881 for (i = 0; i < len; i++) {
882 if (val != p[i]) {
883 return false;
Fabio Utzig39000012018-07-30 12:40:20 -0300884 }
885 }
Fabio Utzig338a19f2018-12-03 08:37:08 -0200886 return true;
887}
888
889static int
Fabio Utzig10ee6482019-08-01 12:04:52 -0300890boot_check_header_erased(struct boot_loader_state *state, int slot)
Fabio Utzig338a19f2018-12-03 08:37:08 -0200891{
892 const struct flash_area *fap;
893 struct image_header *hdr;
894 uint8_t erased_val;
Fabio Utzigb0f04732019-07-31 09:49:19 -0300895 int area_id;
Fabio Utzig338a19f2018-12-03 08:37:08 -0200896 int rc;
897
Fabio Utzig10ee6482019-08-01 12:04:52 -0300898 area_id = flash_area_id_from_multi_image_slot(BOOT_CURR_IMG(state), slot);
Fabio Utzigb0f04732019-07-31 09:49:19 -0300899 rc = flash_area_open(area_id, &fap);
Fabio Utzig338a19f2018-12-03 08:37:08 -0200900 if (rc != 0) {
901 return -1;
902 }
903
904 erased_val = flash_area_erased_val(fap);
905 flash_area_close(fap);
906
Fabio Utzig10ee6482019-08-01 12:04:52 -0300907 hdr = boot_img_hdr(state, slot);
Fabio Utzig338a19f2018-12-03 08:37:08 -0200908 if (!boot_data_is_set_to(erased_val, &hdr->ih_magic, sizeof(hdr->ih_magic))) {
909 return -1;
910 }
911
912 return 0;
Fabio Utzig39000012018-07-30 12:40:20 -0300913}
914
Dominik Ermel0c8c8d52021-02-17 14:45:02 +0000915#if defined(MCUBOOT_DIRECT_XIP)
916/**
917 * Check if image in slot has been set with specific ROM address to run from
918 * and whether the slot starts at that address.
919 *
920 * @returns 0 if IMAGE_F_ROM_FIXED flag is not set;
921 * 0 if IMAGE_F_ROM_FIXED flag is set and ROM address specified in
922 * header matches the slot address;
923 * 1 if IMF_F_ROM_FIXED flag is set but ROM address specified in header
924 * does not match the slot address.
925 */
926static bool
Raef Colesfe57e7d2021-10-15 11:07:09 +0100927boot_rom_address_check(struct boot_loader_state *state)
Dominik Ermel0c8c8d52021-02-17 14:45:02 +0000928{
Mark Horvathccaf7f82021-01-04 18:16:42 +0100929 uint32_t active_slot;
930 const struct image_header *hdr;
931 uint32_t f_off;
932
Raef Colesfe57e7d2021-10-15 11:07:09 +0100933 active_slot = state->slot_usage[BOOT_CURR_IMG(state)].active_slot;
Mark Horvathccaf7f82021-01-04 18:16:42 +0100934 hdr = boot_img_hdr(state, active_slot);
935 f_off = boot_img_slot_off(state, active_slot);
936
Dominik Ermel0c8c8d52021-02-17 14:45:02 +0000937 if (hdr->ih_flags & IMAGE_F_ROM_FIXED && hdr->ih_load_addr != f_off) {
938 BOOT_LOG_WRN("Image in %s slot at 0x%x has been built for offset 0x%x"\
Mark Horvathccaf7f82021-01-04 18:16:42 +0100939 ", skipping",
940 active_slot == 0 ? "primary" : "secondary", f_off,
Dominik Ermel0c8c8d52021-02-17 14:45:02 +0000941 hdr->ih_load_addr);
942
943 /* If there is address mismatch, the image is not bootable from this
944 * slot.
945 */
946 return 1;
947 }
948 return 0;
949}
950#endif
951
Fabio Utzigb1adb1e2019-09-11 11:42:53 -0300952/*
953 * Check that there is a valid image in a slot
954 *
955 * @returns
Raef Colese8fe6cf2020-05-26 13:07:40 +0100956 * FIH_SUCCESS if image was successfully validated
Michael Grand5047f032022-11-24 16:49:56 +0100957 * FIH_NO_BOOTABLE_IMAGE if no bootloable image was found
Raef Colese8fe6cf2020-05-26 13:07:40 +0100958 * FIH_FAILURE on any errors
Fabio Utzigb1adb1e2019-09-11 11:42:53 -0300959 */
Michael Grand5047f032022-11-24 16:49:56 +0100960static fih_ret
Fabio Utzig10ee6482019-08-01 12:04:52 -0300961boot_validate_slot(struct boot_loader_state *state, int slot,
962 struct boot_status *bs)
Christopher Collins92ea77f2016-12-12 15:59:26 -0800963{
964 const struct flash_area *fap;
Marti Bolivarf804f622017-06-12 15:41:48 -0400965 struct image_header *hdr;
Fabio Utzigb0f04732019-07-31 09:49:19 -0300966 int area_id;
Michael Grand5047f032022-11-24 16:49:56 +0100967 FIH_DECLARE(fih_rc, FIH_FAILURE);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800968 int rc;
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300969
Fabio Utzig10ee6482019-08-01 12:04:52 -0300970 area_id = flash_area_id_from_multi_image_slot(BOOT_CURR_IMG(state), slot);
Fabio Utzigb0f04732019-07-31 09:49:19 -0300971 rc = flash_area_open(area_id, &fap);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800972 if (rc != 0) {
Raef Colese8fe6cf2020-05-26 13:07:40 +0100973 FIH_RET(fih_rc);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800974 }
975
Fabio Utzig10ee6482019-08-01 12:04:52 -0300976 hdr = boot_img_hdr(state, slot);
977 if (boot_check_header_erased(state, slot) == 0 ||
978 (hdr->ih_flags & IMAGE_F_NON_BOOTABLE)) {
Fabio Utzig260ec452020-07-09 18:40:07 -0300979
980#if defined(MCUBOOT_SWAP_USING_SCRATCH) || defined(MCUBOOT_SWAP_USING_MOVE)
981 /*
982 * This fixes an issue where an image might be erased, but a trailer
983 * be left behind. It can happen if the image is in the secondary slot
984 * and did not pass validation, in which case the whole slot is erased.
985 * If during the erase operation, a reset occurs, parts of the slot
986 * might have been erased while some did not. The concerning part is
987 * the trailer because it might disable a new image from being loaded
988 * through mcumgr; so we just get rid of the trailer here, if the header
989 * is erased.
990 */
991 if (slot != BOOT_PRIMARY_SLOT) {
992 swap_erase_trailer_sectors(state, fap);
993 }
994#endif
995
David Vincze2d736ad2019-02-18 11:50:22 +0100996 /* No bootable image in slot; continue booting from the primary slot. */
Michael Grand5047f032022-11-24 16:49:56 +0100997 fih_rc = FIH_NO_BOOTABLE_IMAGE;
Fabio Utzig338a19f2018-12-03 08:37:08 -0200998 goto out;
Fabio Utzig39000012018-07-30 12:40:20 -0300999 }
1000
Håkon Øye Amundsen2d1bac12020-01-03 13:08:09 +00001001#if defined(MCUBOOT_OVERWRITE_ONLY) && defined(MCUBOOT_DOWNGRADE_PREVENTION)
1002 if (slot != BOOT_PRIMARY_SLOT) {
1003 /* Check if version of secondary slot is sufficient */
David Vincze8b0b6372020-05-20 19:54:44 +02001004 rc = boot_version_cmp(
1005 &boot_img_hdr(state, BOOT_SECONDARY_SLOT)->ih_ver,
1006 &boot_img_hdr(state, BOOT_PRIMARY_SLOT)->ih_ver);
1007 if (rc < 0 && boot_check_header_erased(state, BOOT_PRIMARY_SLOT)) {
Håkon Øye Amundsen2d1bac12020-01-03 13:08:09 +00001008 BOOT_LOG_ERR("insufficient version in secondary slot");
Dominik Ermel260ae092021-04-23 05:38:45 +00001009 flash_area_erase(fap, 0, flash_area_get_size(fap));
Håkon Øye Amundsen2d1bac12020-01-03 13:08:09 +00001010 /* Image in the secondary slot does not satisfy version requirement.
1011 * Erase the image and continue booting from the primary slot.
1012 */
Michael Grand5047f032022-11-24 16:49:56 +01001013 fih_rc = FIH_NO_BOOTABLE_IMAGE;
Håkon Øye Amundsen2d1bac12020-01-03 13:08:09 +00001014 goto out;
1015 }
1016 }
1017#endif
Michael Grand5047f032022-11-24 16:49:56 +01001018 BOOT_HOOK_CALL_FIH(boot_image_check_hook, FIH_BOOT_HOOK_REGULAR,
Andrzej Puzdrowskib8f39692021-07-02 15:05:37 +02001019 fih_rc, BOOT_CURR_IMG(state), slot);
Michael Grand5047f032022-11-24 16:49:56 +01001020 if (FIH_EQ(fih_rc, FIH_BOOT_HOOK_REGULAR))
Andrzej Puzdrowskib8f39692021-07-02 15:05:37 +02001021 {
1022 FIH_CALL(boot_image_check, fih_rc, state, hdr, fap, bs);
1023 }
Michael Grand5047f032022-11-24 16:49:56 +01001024 if (!boot_is_header_valid(hdr, fap) || FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
Tamas Banfe031092020-09-10 17:32:39 +02001025 if ((slot != BOOT_PRIMARY_SLOT) || ARE_SLOTS_EQUIVALENT()) {
Dominik Ermel260ae092021-04-23 05:38:45 +00001026 flash_area_erase(fap, 0, flash_area_get_size(fap));
David Vinczee574f2d2020-07-10 11:42:03 +02001027 /* Image is invalid, erase it to prevent further unnecessary
1028 * attempts to validate and boot it.
David Brownb38e0442017-02-24 13:57:12 -07001029 */
1030 }
David Brown098de832019-12-10 11:58:01 -07001031#if !defined(__BOOTSIM__)
David Vincze2d736ad2019-02-18 11:50:22 +01001032 BOOT_LOG_ERR("Image in the %s slot is not valid!",
1033 (slot == BOOT_PRIMARY_SLOT) ? "primary" : "secondary");
David Brown098de832019-12-10 11:58:01 -07001034#endif
Michael Grand5047f032022-11-24 16:49:56 +01001035 fih_rc = FIH_NO_BOOTABLE_IMAGE;
Fabio Utzig338a19f2018-12-03 08:37:08 -02001036 goto out;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001037 }
1038
Håkon Øye Amundsene829e9d2021-11-12 14:01:01 +00001039#if MCUBOOT_IMAGE_NUMBER > 1 && !defined(MCUBOOT_ENC_IMAGES) && defined(MCUBOOT_VERIFY_IMG_ADDRESS)
1040 /* Verify that the image in the secondary slot has a reset address
1041 * located in the primary slot. This is done to avoid users incorrectly
1042 * overwriting an application written to the incorrect slot.
1043 * This feature is only supported by ARM platforms.
1044 */
1045 if (area_id == FLASH_AREA_IMAGE_SECONDARY(BOOT_CURR_IMG(state))) {
1046 const struct flash_area *pri_fa = BOOT_IMG_AREA(state, BOOT_PRIMARY_SLOT);
1047 struct image_header *secondary_hdr = boot_img_hdr(state, slot);
1048 uint32_t reset_value = 0;
1049 uint32_t reset_addr = secondary_hdr->ih_hdr_size + sizeof(reset_value);
1050
1051 rc = flash_area_read(fap, reset_addr, &reset_value, sizeof(reset_value));
1052 if (rc != 0) {
Michael Grand5047f032022-11-24 16:49:56 +01001053 fih_rc = FIH_NO_BOOTABLE_IMAGE;
Håkon Øye Amundsene829e9d2021-11-12 14:01:01 +00001054 goto out;
1055 }
1056
1057 if (reset_value < pri_fa->fa_off || reset_value> (pri_fa->fa_off + pri_fa->fa_size)) {
1058 BOOT_LOG_ERR("Reset address of image in secondary slot is not in the primary slot");
1059 BOOT_LOG_ERR("Erasing image from secondary slot");
1060
1061 /* The vector table in the image located in the secondary
1062 * slot does not target the primary slot. This might
1063 * indicate that the image was loaded to the wrong slot.
1064 *
1065 * Erase the image and continue booting from the primary slot.
1066 */
1067 flash_area_erase(fap, 0, fap->fa_size);
Michael Grand5047f032022-11-24 16:49:56 +01001068 fih_rc = FIH_NO_BOOTABLE_IMAGE;
Håkon Øye Amundsene829e9d2021-11-12 14:01:01 +00001069 goto out;
1070 }
1071 }
1072#endif
1073
Fabio Utzig338a19f2018-12-03 08:37:08 -02001074out:
1075 flash_area_close(fap);
Raef Colese8fe6cf2020-05-26 13:07:40 +01001076
1077 FIH_RET(fih_rc);
Christopher Collins92ea77f2016-12-12 15:59:26 -08001078}
1079
David Vinczec3084132020-02-18 14:50:47 +01001080#ifdef MCUBOOT_HW_ROLLBACK_PROT
1081/**
1082 * Updates the stored security counter value with the image's security counter
1083 * value which resides in the given slot, only if it's greater than the stored
1084 * value.
1085 *
1086 * @param image_index Index of the image to determine which security
1087 * counter to update.
1088 * @param slot Slot number of the image.
1089 * @param hdr Pointer to the image header structure of the image
1090 * that is currently stored in the given slot.
1091 *
1092 * @return 0 on success; nonzero on failure.
1093 */
1094static int
1095boot_update_security_counter(uint8_t image_index, int slot,
1096 struct image_header *hdr)
1097{
1098 const struct flash_area *fap = NULL;
1099 uint32_t img_security_cnt;
1100 int rc;
1101
1102 rc = flash_area_open(flash_area_id_from_multi_image_slot(image_index, slot),
1103 &fap);
1104 if (rc != 0) {
1105 rc = BOOT_EFLASH;
1106 goto done;
1107 }
1108
1109 rc = bootutil_get_img_security_cnt(hdr, fap, &img_security_cnt);
1110 if (rc != 0) {
1111 goto done;
1112 }
1113
1114 rc = boot_nv_security_counter_update(image_index, img_security_cnt);
1115 if (rc != 0) {
1116 goto done;
1117 }
1118
1119done:
1120 flash_area_close(fap);
1121 return rc;
1122}
1123#endif /* MCUBOOT_HW_ROLLBACK_PROT */
1124
Tamas Banfe031092020-09-10 17:32:39 +02001125#if !defined(MCUBOOT_DIRECT_XIP) && !defined(MCUBOOT_RAM_LOAD)
David Vinczee574f2d2020-07-10 11:42:03 +02001126/**
1127 * Determines which swap operation to perform, if any. If it is determined
1128 * that a swap operation is required, the image in the secondary slot is checked
1129 * for validity. If the image in the secondary slot is invalid, it is erased,
1130 * and a swap type of "none" is indicated.
1131 *
1132 * @return The type of swap to perform (BOOT_SWAP_TYPE...)
1133 */
1134static int
1135boot_validated_swap_type(struct boot_loader_state *state,
1136 struct boot_status *bs)
1137{
1138 int swap_type;
Michael Grand5047f032022-11-24 16:49:56 +01001139 FIH_DECLARE(fih_rc, FIH_FAILURE);
David Vinczee574f2d2020-07-10 11:42:03 +02001140
1141 swap_type = boot_swap_type_multi(BOOT_CURR_IMG(state));
1142 if (BOOT_IS_UPGRADE(swap_type)) {
1143 /* Boot loader wants to switch to the secondary slot.
1144 * Ensure image is valid.
1145 */
Raef Colese8fe6cf2020-05-26 13:07:40 +01001146 FIH_CALL(boot_validate_slot, fih_rc, state, BOOT_SECONDARY_SLOT, bs);
Michael Grand5047f032022-11-24 16:49:56 +01001147 if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
1148 if (FIH_EQ(fih_rc, FIH_NO_BOOTABLE_IMAGE)) {
Raef Colese8fe6cf2020-05-26 13:07:40 +01001149 swap_type = BOOT_SWAP_TYPE_NONE;
1150 } else {
1151 swap_type = BOOT_SWAP_TYPE_FAIL;
1152 }
David Vinczee574f2d2020-07-10 11:42:03 +02001153 }
1154 }
1155
1156 return swap_type;
1157}
David Brown94ed12c2021-05-26 16:28:14 -06001158#endif
David Vinczee574f2d2020-07-10 11:42:03 +02001159
Christopher Collins92ea77f2016-12-12 15:59:26 -08001160/**
Christopher Collins92ea77f2016-12-12 15:59:26 -08001161 * Erases a region of flash.
1162 *
Fabio Utzigba829042018-09-18 08:29:34 -03001163 * @param flash_area The flash_area containing the region to erase.
Christopher Collins92ea77f2016-12-12 15:59:26 -08001164 * @param off The offset within the flash area to start the
1165 * erase.
1166 * @param sz The number of bytes to erase.
1167 *
1168 * @return 0 on success; nonzero on failure.
1169 */
Fabio Utzig12d59162019-11-28 10:01:59 -03001170int
Fabio Utzigc28005b2019-09-10 12:18:29 -03001171boot_erase_region(const struct flash_area *fap, uint32_t off, uint32_t sz)
Christopher Collins92ea77f2016-12-12 15:59:26 -08001172{
Fabio Utzigba829042018-09-18 08:29:34 -03001173 return flash_area_erase(fap, off, sz);
Christopher Collins92ea77f2016-12-12 15:59:26 -08001174}
1175
David Brown94ed12c2021-05-26 16:28:14 -06001176#if !defined(MCUBOOT_DIRECT_XIP) && !defined(MCUBOOT_RAM_LOAD)
Dominik Ermel256bc372022-12-07 15:51:31 +00001177
1178#if defined(MCUBOOT_ENC_IMAGES) || defined(MCUBOOT_SWAP_SAVE_ENCTLV)
1179/* Replacement for memset(p, 0, sizeof(*p) that does not get
1180 * optimized out.
1181 */
1182static void like_mbedtls_zeroize(void *p, size_t n)
1183{
1184 volatile unsigned char *v = (unsigned char *)p;
1185
1186 for (size_t i = 0; i < n; i++) {
1187 v[i] = 0;
1188 }
1189}
1190#endif
1191
Christopher Collins92ea77f2016-12-12 15:59:26 -08001192/**
1193 * Copies the contents of one flash region to another. You must erase the
1194 * destination region prior to calling this function.
1195 *
1196 * @param flash_area_id_src The ID of the source flash area.
1197 * @param flash_area_id_dst The ID of the destination flash area.
1198 * @param off_src The offset within the source flash area to
1199 * copy from.
1200 * @param off_dst The offset within the destination flash area to
1201 * copy to.
1202 * @param sz The number of bytes to copy.
1203 *
1204 * @return 0 on success; nonzero on failure.
1205 */
Fabio Utzig12d59162019-11-28 10:01:59 -03001206int
Fabio Utzigc28005b2019-09-10 12:18:29 -03001207boot_copy_region(struct boot_loader_state *state,
Fabio Utzig10ee6482019-08-01 12:04:52 -03001208 const struct flash_area *fap_src,
Fabio Utzigba829042018-09-18 08:29:34 -03001209 const struct flash_area *fap_dst,
Christopher Collins92ea77f2016-12-12 15:59:26 -08001210 uint32_t off_src, uint32_t off_dst, uint32_t sz)
1211{
Christopher Collins92ea77f2016-12-12 15:59:26 -08001212 uint32_t bytes_copied;
1213 int chunk_sz;
1214 int rc;
Fabio Utzigba829042018-09-18 08:29:34 -03001215#ifdef MCUBOOT_ENC_IMAGES
Dominik Ermel6fe259b2024-07-18 11:40:53 +00001216 uint32_t off = off_dst;
Fabio Utziga87cc7d2019-08-26 11:21:45 -03001217 uint32_t tlv_off;
Fabio Utzigba829042018-09-18 08:29:34 -03001218 size_t blk_off;
1219 struct image_header *hdr;
1220 uint16_t idx;
1221 uint32_t blk_sz;
Dominik Ermel6fe259b2024-07-18 11:40:53 +00001222 uint8_t image_index = BOOT_CURR_IMG(state);
Thomas Altenbach08d2d942024-04-25 15:29:21 +02001223 bool encrypted_src;
1224 bool encrypted_dst;
Dominik Ermel6fe259b2024-07-18 11:40:53 +00001225 /* Assuming the secondary slot is source; note that 0 here not only
1226 * means that primary slot is source, but also that there will be
1227 * encryption happening, if it is 1 then there is decryption from
1228 * secondary slot.
1229 */
Dominik Ermel3f112862024-07-17 14:43:05 +00001230 int source_slot = 1;
Dominik Ermel6fe259b2024-07-18 11:40:53 +00001231 /* In case of encryption enabled, we may have to do more work than
1232 * just copy bytes */
1233 bool only_copy = false;
1234#else
1235 (void)state;
Fabio Utzigba829042018-09-18 08:29:34 -03001236#endif
Christopher Collins92ea77f2016-12-12 15:59:26 -08001237
Kristine Jassmann73c38c62021-02-03 16:56:14 +00001238 TARGET_STATIC uint8_t buf[BUF_SZ] __attribute__((aligned(4)));
Fabio Utzig10ee6482019-08-01 12:04:52 -03001239
Dominik Ermel6fe259b2024-07-18 11:40:53 +00001240#ifdef MCUBOOT_ENC_IMAGES
1241 encrypted_src = (flash_area_get_id(fap_src) != FLASH_AREA_IMAGE_PRIMARY(image_index));
1242 encrypted_dst = (flash_area_get_id(fap_dst) != FLASH_AREA_IMAGE_PRIMARY(image_index));
1243
1244 if (encrypted_src != encrypted_dst) {
1245 if (encrypted_dst) {
1246 /* Need encryption, metadata from the primary slot */
1247 hdr = boot_img_hdr(state, BOOT_PRIMARY_SLOT);
1248 source_slot = 0;
1249 } else {
1250 /* Need decryption, metadata from the secondary slot */
1251 hdr = boot_img_hdr(state, BOOT_SECONDARY_SLOT);
1252 source_slot = 1;
1253 }
1254 } else {
1255 /* In case when source and targe is the same area, this means that we
1256 * only have to copy bytes, no encryption or decryption.
1257 */
1258 only_copy = true;
1259 }
Fabio Utzig10ee6482019-08-01 12:04:52 -03001260#endif
Christopher Collins92ea77f2016-12-12 15:59:26 -08001261
Christopher Collins92ea77f2016-12-12 15:59:26 -08001262 bytes_copied = 0;
1263 while (bytes_copied < sz) {
1264 if (sz - bytes_copied > sizeof buf) {
1265 chunk_sz = sizeof buf;
1266 } else {
1267 chunk_sz = sz - bytes_copied;
1268 }
1269
1270 rc = flash_area_read(fap_src, off_src + bytes_copied, buf, chunk_sz);
1271 if (rc != 0) {
Fabio Utzigba829042018-09-18 08:29:34 -03001272 return BOOT_EFLASH;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001273 }
1274
Fabio Utzigba829042018-09-18 08:29:34 -03001275#ifdef MCUBOOT_ENC_IMAGES
Dominik Ermel6fe259b2024-07-18 11:40:53 +00001276 /* If only copy, then does not matter if header indicates need for
1277 * encryptio/decryptio, we just copy data. */
1278 if (!only_copy && IS_ENCRYPTED(hdr)) {
1279 uint32_t abs_off = off + bytes_copied;
1280 if (abs_off < hdr->ih_hdr_size) {
1281 /* do not decrypt header */
1282 if (abs_off + chunk_sz > hdr->ih_hdr_size) {
1283 /* The lower part of the chunk contains header data */
1284 blk_off = 0;
1285 blk_sz = chunk_sz - (hdr->ih_hdr_size - abs_off);
1286 idx = hdr->ih_hdr_size - abs_off;
1287 } else {
1288 /* The chunk contains exclusively header data */
1289 blk_sz = 0; /* nothing to decrypt */
1290 }
Thomas Altenbach08d2d942024-04-25 15:29:21 +02001291 } else {
Dominik Ermel6fe259b2024-07-18 11:40:53 +00001292 idx = 0;
1293 blk_sz = chunk_sz;
1294 blk_off = (abs_off - hdr->ih_hdr_size) & 0xf;
Fabio Utzig74aef312019-11-28 11:05:34 -03001295 }
Thomas Altenbach08d2d942024-04-25 15:29:21 +02001296
Dominik Ermel6fe259b2024-07-18 11:40:53 +00001297 if (blk_sz > 0)
1298 {
1299 tlv_off = BOOT_TLV_OFF(hdr);
1300 if (abs_off + chunk_sz > tlv_off) {
1301 /* do not decrypt TLVs */
1302 if (abs_off >= tlv_off) {
1303 blk_sz = 0;
Andrzej Puzdrowskie38b0af2021-11-04 13:34:11 +01001304 } else {
Dominik Ermel6fe259b2024-07-18 11:40:53 +00001305 blk_sz = tlv_off - abs_off;
Andrzej Puzdrowskie38b0af2021-11-04 13:34:11 +01001306 }
Fabio Utzigba829042018-09-18 08:29:34 -03001307 }
Dominik Ermel6fe259b2024-07-18 11:40:53 +00001308 boot_encrypt(BOOT_CURR_ENC(state), source_slot,
1309 (abs_off + idx) - hdr->ih_hdr_size, blk_sz,
1310 blk_off, &buf[idx]);
Fabio Utzigba829042018-09-18 08:29:34 -03001311 }
1312 }
1313#endif
1314
Christopher Collins92ea77f2016-12-12 15:59:26 -08001315 rc = flash_area_write(fap_dst, off_dst + bytes_copied, buf, chunk_sz);
1316 if (rc != 0) {
Fabio Utzigba829042018-09-18 08:29:34 -03001317 return BOOT_EFLASH;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001318 }
1319
1320 bytes_copied += chunk_sz;
Fabio Utzig853657c2019-05-07 08:06:07 -03001321
1322 MCUBOOT_WATCHDOG_FEED();
Christopher Collins92ea77f2016-12-12 15:59:26 -08001323 }
1324
Fabio Utzigba829042018-09-18 08:29:34 -03001325 return 0;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001326}
1327
Christopher Collins92ea77f2016-12-12 15:59:26 -08001328/**
David Vincze2d736ad2019-02-18 11:50:22 +01001329 * Overwrite primary slot with the image contained in the secondary slot.
1330 * If a prior copy operation was interrupted by a system reset, this function
1331 * redos the copy.
Christopher Collins92ea77f2016-12-12 15:59:26 -08001332 *
1333 * @param bs The current boot status. This function reads
1334 * this struct to determine if it is resuming
1335 * an interrupted swap operation. This
1336 * function writes the updated status to this
1337 * function on return.
1338 *
1339 * @return 0 on success; nonzero on failure.
1340 */
Fabio Utzig338a19f2018-12-03 08:37:08 -02001341#if defined(MCUBOOT_OVERWRITE_ONLY) || defined(MCUBOOT_BOOTSTRAP)
David Brown17609d82017-05-05 09:41:34 -06001342static int
Fabio Utzig10ee6482019-08-01 12:04:52 -03001343boot_copy_image(struct boot_loader_state *state, struct boot_status *bs)
David Brown17609d82017-05-05 09:41:34 -06001344{
Marti Bolivard3269fd2017-06-12 16:31:12 -04001345 size_t sect_count;
1346 size_t sect;
David Brown17609d82017-05-05 09:41:34 -06001347 int rc;
Fabio Utzig13d9e352017-10-05 20:32:31 -03001348 size_t size;
Marti Bolivard3269fd2017-06-12 16:31:12 -04001349 size_t this_size;
Fabio Utzig13d9e352017-10-05 20:32:31 -03001350 size_t last_sector;
David Vincze2d736ad2019-02-18 11:50:22 +01001351 const struct flash_area *fap_primary_slot;
1352 const struct flash_area *fap_secondary_slot;
Fabio Utzigb0f04732019-07-31 09:49:19 -03001353 uint8_t image_index;
David Vincze2d736ad2019-02-18 11:50:22 +01001354
Fabio Utzigb4f88102020-10-04 10:16:24 -03001355#if defined(MCUBOOT_OVERWRITE_ONLY_FAST)
1356 uint32_t sector;
1357 uint32_t trailer_sz;
1358 uint32_t off;
1359 uint32_t sz;
1360#endif
1361
Fabio Utzigaaf767c2017-12-05 10:22:46 -02001362 (void)bs;
1363
Fabio Utzig13d9e352017-10-05 20:32:31 -03001364#if defined(MCUBOOT_OVERWRITE_ONLY_FAST)
1365 uint32_t src_size = 0;
Fabio Utzigd638b172019-08-09 10:38:05 -03001366 rc = boot_read_image_size(state, BOOT_SECONDARY_SLOT, &src_size);
Fabio Utzig13d9e352017-10-05 20:32:31 -03001367 assert(rc == 0);
1368#endif
David Brown17609d82017-05-05 09:41:34 -06001369
Fabio Utzigb0f04732019-07-31 09:49:19 -03001370 image_index = BOOT_CURR_IMG(state);
1371
Antonio de Angelisba5fb1c2022-10-11 10:10:37 +01001372 BOOT_LOG_INF("Image %d upgrade secondary slot -> primary slot", image_index);
1373 BOOT_LOG_INF("Erasing the primary slot");
1374
Fabio Utzigb0f04732019-07-31 09:49:19 -03001375 rc = flash_area_open(FLASH_AREA_IMAGE_PRIMARY(image_index),
1376 &fap_primary_slot);
Fabio Utzigba829042018-09-18 08:29:34 -03001377 assert (rc == 0);
1378
Fabio Utzigb0f04732019-07-31 09:49:19 -03001379 rc = flash_area_open(FLASH_AREA_IMAGE_SECONDARY(image_index),
1380 &fap_secondary_slot);
Fabio Utzigba829042018-09-18 08:29:34 -03001381 assert (rc == 0);
1382
Fabio Utzig10ee6482019-08-01 12:04:52 -03001383 sect_count = boot_img_num_sectors(state, BOOT_PRIMARY_SLOT);
Fabio Utzig13d9e352017-10-05 20:32:31 -03001384 for (sect = 0, size = 0; sect < sect_count; sect++) {
Fabio Utzig10ee6482019-08-01 12:04:52 -03001385 this_size = boot_img_sector_size(state, BOOT_PRIMARY_SLOT, sect);
Fabio Utzigc28005b2019-09-10 12:18:29 -03001386 rc = boot_erase_region(fap_primary_slot, size, this_size);
David Brown17609d82017-05-05 09:41:34 -06001387 assert(rc == 0);
1388
Fabio Utzig13d9e352017-10-05 20:32:31 -03001389#if defined(MCUBOOT_OVERWRITE_ONLY_FAST)
Fabio Utzigb4f88102020-10-04 10:16:24 -03001390 if ((size + this_size) >= src_size) {
1391 size += src_size - size;
1392 size += BOOT_WRITE_SZ(state) - (size % BOOT_WRITE_SZ(state));
Fabio Utzig13d9e352017-10-05 20:32:31 -03001393 break;
1394 }
1395#endif
Fabio Utzigb4f88102020-10-04 10:16:24 -03001396
1397 size += this_size;
David Brown17609d82017-05-05 09:41:34 -06001398 }
1399
Fabio Utzigb4f88102020-10-04 10:16:24 -03001400#if defined(MCUBOOT_OVERWRITE_ONLY_FAST)
1401 trailer_sz = boot_trailer_sz(BOOT_WRITE_SZ(state));
1402 sector = boot_img_num_sectors(state, BOOT_PRIMARY_SLOT) - 1;
1403 sz = 0;
1404 do {
1405 sz += boot_img_sector_size(state, BOOT_PRIMARY_SLOT, sector);
1406 off = boot_img_sector_off(state, BOOT_PRIMARY_SLOT, sector);
1407 sector--;
1408 } while (sz < trailer_sz);
1409
1410 rc = boot_erase_region(fap_primary_slot, off, sz);
1411 assert(rc == 0);
1412#endif
1413
Fabio Utzigba829042018-09-18 08:29:34 -03001414#ifdef MCUBOOT_ENC_IMAGES
Fabio Utzig10ee6482019-08-01 12:04:52 -03001415 if (IS_ENCRYPTED(boot_img_hdr(state, BOOT_SECONDARY_SLOT))) {
Dominik Ermel7f9ac972024-07-12 19:21:40 +00001416 rc = boot_enc_load(BOOT_CURR_ENC(state), BOOT_SECONDARY_SLOT,
Fabio Utzig10ee6482019-08-01 12:04:52 -03001417 boot_img_hdr(state, BOOT_SECONDARY_SLOT),
Fabio Utzig4741c452019-12-19 15:32:41 -03001418 fap_secondary_slot, bs);
David Vincze2d736ad2019-02-18 11:50:22 +01001419
Fabio Utzigba829042018-09-18 08:29:34 -03001420 if (rc < 0) {
1421 return BOOT_EBADIMAGE;
1422 }
Fabio Utzig4741c452019-12-19 15:32:41 -03001423 if (rc == 0 && boot_enc_set_key(BOOT_CURR_ENC(state), 1, bs)) {
Fabio Utzigba829042018-09-18 08:29:34 -03001424 return BOOT_EBADIMAGE;
1425 }
1426 }
1427#endif
1428
Antonio de Angelis48547002023-04-14 09:47:09 +01001429 BOOT_LOG_INF("Image %d copying the secondary slot to the primary slot: 0x%zx bytes",
1430 image_index, size);
Fabio Utzigc28005b2019-09-10 12:18:29 -03001431 rc = boot_copy_region(state, fap_secondary_slot, fap_primary_slot, 0, 0, size);
Fabio Utzigb4f88102020-10-04 10:16:24 -03001432 if (rc != 0) {
1433 return rc;
1434 }
1435
1436#if defined(MCUBOOT_OVERWRITE_ONLY_FAST)
1437 rc = boot_write_magic(fap_primary_slot);
1438 if (rc != 0) {
1439 return rc;
1440 }
1441#endif
David Brown17609d82017-05-05 09:41:34 -06001442
Andrzej Puzdrowskib8f39692021-07-02 15:05:37 +02001443 rc = BOOT_HOOK_CALL(boot_copy_region_post_hook, 0, BOOT_CURR_IMG(state),
1444 BOOT_IMG_AREA(state, BOOT_PRIMARY_SLOT), size);
1445 if (rc != 0) {
1446 return rc;
1447 }
1448
David Vinczec3084132020-02-18 14:50:47 +01001449#ifdef MCUBOOT_HW_ROLLBACK_PROT
1450 /* Update the stored security counter with the new image's security counter
1451 * value. Both slots hold the new image at this point, but the secondary
1452 * slot's image header must be passed since the image headers in the
1453 * boot_data structure have not been updated yet.
1454 */
1455 rc = boot_update_security_counter(BOOT_CURR_IMG(state), BOOT_PRIMARY_SLOT,
1456 boot_img_hdr(state, BOOT_SECONDARY_SLOT));
1457 if (rc != 0) {
1458 BOOT_LOG_ERR("Security counter update failed after image upgrade.");
1459 return rc;
1460 }
1461#endif /* MCUBOOT_HW_ROLLBACK_PROT */
1462
Petr Buchtac5a528b2024-02-24 08:10:38 +01001463#ifndef MCUBOOT_OVERWRITE_ONLY_KEEP_BACKUP
Fabio Utzig13d9e352017-10-05 20:32:31 -03001464 /*
1465 * Erases header and trailer. The trailer is erased because when a new
1466 * image is written without a trailer as is the case when using newt, the
1467 * trailer that was left might trigger a new upgrade.
1468 */
Christopher Collins2c88e692019-05-22 15:10:14 -07001469 BOOT_LOG_DBG("erasing secondary header");
Fabio Utzigc28005b2019-09-10 12:18:29 -03001470 rc = boot_erase_region(fap_secondary_slot,
Fabio Utzig10ee6482019-08-01 12:04:52 -03001471 boot_img_sector_off(state, BOOT_SECONDARY_SLOT, 0),
1472 boot_img_sector_size(state, BOOT_SECONDARY_SLOT, 0));
David Brown17609d82017-05-05 09:41:34 -06001473 assert(rc == 0);
Petr Buchtac5a528b2024-02-24 08:10:38 +01001474#endif
1475
Fabio Utzig10ee6482019-08-01 12:04:52 -03001476 last_sector = boot_img_num_sectors(state, BOOT_SECONDARY_SLOT) - 1;
Christopher Collins2c88e692019-05-22 15:10:14 -07001477 BOOT_LOG_DBG("erasing secondary trailer");
Fabio Utzigc28005b2019-09-10 12:18:29 -03001478 rc = boot_erase_region(fap_secondary_slot,
Fabio Utzig10ee6482019-08-01 12:04:52 -03001479 boot_img_sector_off(state, BOOT_SECONDARY_SLOT,
1480 last_sector),
1481 boot_img_sector_size(state, BOOT_SECONDARY_SLOT,
1482 last_sector));
Fabio Utzig13d9e352017-10-05 20:32:31 -03001483 assert(rc == 0);
1484
David Vincze2d736ad2019-02-18 11:50:22 +01001485 flash_area_close(fap_primary_slot);
1486 flash_area_close(fap_secondary_slot);
Fabio Utzigba829042018-09-18 08:29:34 -03001487
David Vincze2d736ad2019-02-18 11:50:22 +01001488 /* TODO: Perhaps verify the primary slot's signature again? */
David Brown17609d82017-05-05 09:41:34 -06001489
1490 return 0;
1491}
Fabio Utzig338a19f2018-12-03 08:37:08 -02001492#endif
Fabio Utzigba829042018-09-18 08:29:34 -03001493
Christopher Collinsa1c12042019-05-23 14:00:28 -07001494#if !defined(MCUBOOT_OVERWRITE_ONLY)
Fabio Utzigba829042018-09-18 08:29:34 -03001495/**
1496 * Swaps the two images in flash. If a prior copy operation was interrupted
1497 * by a system reset, this function completes that operation.
1498 *
1499 * @param bs The current boot status. This function reads
1500 * this struct to determine if it is resuming
1501 * an interrupted swap operation. This
1502 * function writes the updated status to this
1503 * function on return.
1504 *
1505 * @return 0 on success; nonzero on failure.
1506 */
Christopher Collins92ea77f2016-12-12 15:59:26 -08001507static int
Fabio Utzig10ee6482019-08-01 12:04:52 -03001508boot_swap_image(struct boot_loader_state *state, struct boot_status *bs)
Christopher Collins92ea77f2016-12-12 15:59:26 -08001509{
Fabio Utzig2473ac02017-05-02 12:45:02 -03001510 struct image_header *hdr;
Fabio Utzigba829042018-09-18 08:29:34 -03001511 const struct flash_area *fap;
Dominik Ermel472d4c72023-02-10 13:29:58 +00001512#ifdef MCUBOOT_ENC_IMAGES
Fabio Utzigba829042018-09-18 08:29:34 -03001513 uint8_t slot;
1514 uint8_t i;
Fabio Utzigba829042018-09-18 08:29:34 -03001515#endif
Fabio Utzig2473ac02017-05-02 12:45:02 -03001516 uint32_t size;
1517 uint32_t copy_size;
Fabio Utzigb0f04732019-07-31 09:49:19 -03001518 uint8_t image_index;
Fabio Utzig2473ac02017-05-02 12:45:02 -03001519 int rc;
1520
1521 /* FIXME: just do this if asked by user? */
1522
1523 size = copy_size = 0;
Fabio Utzig10ee6482019-08-01 12:04:52 -03001524 image_index = BOOT_CURR_IMG(state);
Fabio Utzig2473ac02017-05-02 12:45:02 -03001525
Fabio Utzig12d59162019-11-28 10:01:59 -03001526 if (boot_status_is_reset(bs)) {
Fabio Utzig46490722017-09-04 15:34:32 -03001527 /*
1528 * No swap ever happened, so need to find the largest image which
1529 * will be used to determine the amount of sectors to swap.
1530 */
Fabio Utzig10ee6482019-08-01 12:04:52 -03001531 hdr = boot_img_hdr(state, BOOT_PRIMARY_SLOT);
Fabio Utzig2473ac02017-05-02 12:45:02 -03001532 if (hdr->ih_magic == IMAGE_MAGIC) {
Fabio Utzigd638b172019-08-09 10:38:05 -03001533 rc = boot_read_image_size(state, BOOT_PRIMARY_SLOT, &copy_size);
David Brownf5b33d82017-09-01 10:58:27 -06001534 assert(rc == 0);
Fabio Utzig2473ac02017-05-02 12:45:02 -03001535 }
Fabio Utzig2473ac02017-05-02 12:45:02 -03001536
Fabio Utzigba829042018-09-18 08:29:34 -03001537#ifdef MCUBOOT_ENC_IMAGES
Fabio Utzig2fc80df2018-12-14 06:47:38 -02001538 if (IS_ENCRYPTED(hdr)) {
Fabio Utzig10ee6482019-08-01 12:04:52 -03001539 fap = BOOT_IMG_AREA(state, BOOT_PRIMARY_SLOT);
Dominik Ermel7f9ac972024-07-12 19:21:40 +00001540 rc = boot_enc_load(BOOT_CURR_ENC(state), 0, hdr, fap, bs);
Fabio Utzigba829042018-09-18 08:29:34 -03001541 assert(rc >= 0);
1542
1543 if (rc == 0) {
Fabio Utzig4741c452019-12-19 15:32:41 -03001544 rc = boot_enc_set_key(BOOT_CURR_ENC(state), 0, bs);
Fabio Utzigba829042018-09-18 08:29:34 -03001545 assert(rc == 0);
1546 } else {
1547 rc = 0;
1548 }
1549 } else {
Kristine Jassmann73c38c62021-02-03 16:56:14 +00001550 memset(bs->enckey[0], 0xff, BOOT_ENC_KEY_ALIGN_SIZE);
Fabio Utzigba829042018-09-18 08:29:34 -03001551 }
1552#endif
1553
Fabio Utzig10ee6482019-08-01 12:04:52 -03001554 hdr = boot_img_hdr(state, BOOT_SECONDARY_SLOT);
Fabio Utzig46490722017-09-04 15:34:32 -03001555 if (hdr->ih_magic == IMAGE_MAGIC) {
Fabio Utzigd638b172019-08-09 10:38:05 -03001556 rc = boot_read_image_size(state, BOOT_SECONDARY_SLOT, &size);
Fabio Utzig46490722017-09-04 15:34:32 -03001557 assert(rc == 0);
1558 }
1559
Fabio Utzigba829042018-09-18 08:29:34 -03001560#ifdef MCUBOOT_ENC_IMAGES
Fabio Utzig10ee6482019-08-01 12:04:52 -03001561 hdr = boot_img_hdr(state, BOOT_SECONDARY_SLOT);
Fabio Utzig2fc80df2018-12-14 06:47:38 -02001562 if (IS_ENCRYPTED(hdr)) {
Fabio Utzig10ee6482019-08-01 12:04:52 -03001563 fap = BOOT_IMG_AREA(state, BOOT_SECONDARY_SLOT);
Dominik Ermel7f9ac972024-07-12 19:21:40 +00001564 rc = boot_enc_load(BOOT_CURR_ENC(state), 1, hdr, fap, bs);
Fabio Utzigba829042018-09-18 08:29:34 -03001565 assert(rc >= 0);
1566
1567 if (rc == 0) {
Fabio Utzig4741c452019-12-19 15:32:41 -03001568 rc = boot_enc_set_key(BOOT_CURR_ENC(state), 1, bs);
Fabio Utzigba829042018-09-18 08:29:34 -03001569 assert(rc == 0);
1570 } else {
1571 rc = 0;
1572 }
1573 } else {
Kristine Jassmann73c38c62021-02-03 16:56:14 +00001574 memset(bs->enckey[1], 0xff, BOOT_ENC_KEY_ALIGN_SIZE);
Fabio Utzigba829042018-09-18 08:29:34 -03001575 }
1576#endif
1577
Fabio Utzig46490722017-09-04 15:34:32 -03001578 if (size > copy_size) {
1579 copy_size = size;
1580 }
1581
1582 bs->swap_size = copy_size;
1583 } else {
1584 /*
1585 * If a swap was under way, the swap_size should already be present
1586 * in the trailer...
1587 */
Dominik Ermel472d4c72023-02-10 13:29:58 +00001588
1589 rc = boot_find_status(image_index, &fap);
1590 assert(fap != NULL);
1591 rc = boot_read_swap_size(fap, &bs->swap_size);
Fabio Utzig46490722017-09-04 15:34:32 -03001592 assert(rc == 0);
1593
1594 copy_size = bs->swap_size;
Fabio Utzigba829042018-09-18 08:29:34 -03001595
1596#ifdef MCUBOOT_ENC_IMAGES
Fabio Utzig4741c452019-12-19 15:32:41 -03001597 for (slot = 0; slot < BOOT_NUM_SLOTS; slot++) {
Dominik Ermel472d4c72023-02-10 13:29:58 +00001598 rc = boot_read_enc_key(fap, slot, bs);
Fabio Utzigba829042018-09-18 08:29:34 -03001599 assert(rc == 0);
1600
1601 for (i = 0; i < BOOT_ENC_KEY_SIZE; i++) {
Fabio Utzig1c7d9592018-12-03 10:35:56 -02001602 if (bs->enckey[slot][i] != 0xff) {
Fabio Utzigba829042018-09-18 08:29:34 -03001603 break;
1604 }
1605 }
1606
Dominik Ermel7e3a1ce2024-07-12 17:19:17 +00001607 boot_enc_init(BOOT_CURR_ENC(state), slot);
1608
Fabio Utzigba829042018-09-18 08:29:34 -03001609 if (i != BOOT_ENC_KEY_SIZE) {
Fabio Utzig4741c452019-12-19 15:32:41 -03001610 boot_enc_set_key(BOOT_CURR_ENC(state), slot, bs);
Fabio Utzigba829042018-09-18 08:29:34 -03001611 }
1612 }
1613#endif
Dominik Ermel472d4c72023-02-10 13:29:58 +00001614 flash_area_close(fap);
Fabio Utzig2473ac02017-05-02 12:45:02 -03001615 }
1616
Fabio Utzig12d59162019-11-28 10:01:59 -03001617 swap_run(state, bs, copy_size);
Christopher Collins92ea77f2016-12-12 15:59:26 -08001618
David Vincze2d736ad2019-02-18 11:50:22 +01001619#ifdef MCUBOOT_VALIDATE_PRIMARY_SLOT
Fabio Utzig12d59162019-11-28 10:01:59 -03001620 extern int boot_status_fails;
Fabio Utziga0e1cce2017-11-23 20:04:01 -02001621 if (boot_status_fails > 0) {
Christopher Collins2c88e692019-05-22 15:10:14 -07001622 BOOT_LOG_WRN("%d status write fails performing the swap",
1623 boot_status_fails);
Fabio Utziga0e1cce2017-11-23 20:04:01 -02001624 }
1625#endif
Sigvart Hovland3fd4cd42022-09-09 13:21:18 +02001626 rc = BOOT_HOOK_CALL(boot_copy_region_post_hook, 0, BOOT_CURR_IMG(state),
1627 BOOT_IMG_AREA(state, BOOT_PRIMARY_SLOT), size);
Fabio Utziga0e1cce2017-11-23 20:04:01 -02001628
Christopher Collins92ea77f2016-12-12 15:59:26 -08001629 return 0;
1630}
David Brown17609d82017-05-05 09:41:34 -06001631#endif
Christopher Collins92ea77f2016-12-12 15:59:26 -08001632
David Vinczee32483f2019-06-13 10:46:24 +02001633
Christopher Collins92ea77f2016-12-12 15:59:26 -08001634/**
David Vinczeba3bd602019-06-17 16:01:43 +02001635 * Performs a clean (not aborted) image update.
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001636 *
David Vinczeba3bd602019-06-17 16:01:43 +02001637 * @param bs The current boot status.
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001638 *
1639 * @return 0 on success; nonzero on failure.
1640 */
1641static int
Fabio Utzig10ee6482019-08-01 12:04:52 -03001642boot_perform_update(struct boot_loader_state *state, struct boot_status *bs)
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001643{
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001644 int rc;
Fabio Utzig10ee6482019-08-01 12:04:52 -03001645#ifndef MCUBOOT_OVERWRITE_ONLY
1646 uint8_t swap_type;
1647#endif
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001648
David Vinczeba3bd602019-06-17 16:01:43 +02001649 /* At this point there are no aborted swaps. */
1650#if defined(MCUBOOT_OVERWRITE_ONLY)
Fabio Utzig10ee6482019-08-01 12:04:52 -03001651 rc = boot_copy_image(state, bs);
David Vinczeba3bd602019-06-17 16:01:43 +02001652#elif defined(MCUBOOT_BOOTSTRAP)
1653 /* Check if the image update was triggered by a bad image in the
1654 * primary slot (the validity of the image in the secondary slot had
1655 * already been checked).
1656 */
Michael Grand5047f032022-11-24 16:49:56 +01001657 FIH_DECLARE(fih_rc, FIH_FAILURE);
Raef Colese8fe6cf2020-05-26 13:07:40 +01001658 rc = boot_check_header_erased(state, BOOT_PRIMARY_SLOT);
1659 FIH_CALL(boot_validate_slot, fih_rc, state, BOOT_PRIMARY_SLOT, bs);
Michael Grand5047f032022-11-24 16:49:56 +01001660 if (rc == 0 || FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
Fabio Utzig10ee6482019-08-01 12:04:52 -03001661 rc = boot_copy_image(state, bs);
David Vinczeba3bd602019-06-17 16:01:43 +02001662 } else {
Fabio Utzig10ee6482019-08-01 12:04:52 -03001663 rc = boot_swap_image(state, bs);
David Vinczeba3bd602019-06-17 16:01:43 +02001664 }
1665#else
Fabio Utzig10ee6482019-08-01 12:04:52 -03001666 rc = boot_swap_image(state, bs);
David Vinczeba3bd602019-06-17 16:01:43 +02001667#endif
Fabio Utzig7ebb7c22017-04-26 10:59:31 -03001668 assert(rc == 0);
David Vinczeba3bd602019-06-17 16:01:43 +02001669
1670#ifndef MCUBOOT_OVERWRITE_ONLY
1671 /* The following state needs image_ok be explicitly set after the
1672 * swap was finished to avoid a new revert.
1673 */
Fabio Utzig10ee6482019-08-01 12:04:52 -03001674 swap_type = BOOT_SWAP_TYPE(state);
1675 if (swap_type == BOOT_SWAP_TYPE_REVERT ||
1676 swap_type == BOOT_SWAP_TYPE_PERM) {
Fabio Utzig12d59162019-11-28 10:01:59 -03001677 rc = swap_set_image_ok(BOOT_CURR_IMG(state));
David Vinczeba3bd602019-06-17 16:01:43 +02001678 if (rc != 0) {
Fabio Utzig10ee6482019-08-01 12:04:52 -03001679 BOOT_SWAP_TYPE(state) = swap_type = BOOT_SWAP_TYPE_PANIC;
David Vinczeba3bd602019-06-17 16:01:43 +02001680 }
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001681 }
1682
David Vinczec3084132020-02-18 14:50:47 +01001683#ifdef MCUBOOT_HW_ROLLBACK_PROT
1684 if (swap_type == BOOT_SWAP_TYPE_PERM) {
1685 /* Update the stored security counter with the new image's security
1686 * counter value. The primary slot holds the new image at this point,
1687 * but the secondary slot's image header must be passed since image
1688 * headers in the boot_data structure have not been updated yet.
1689 *
1690 * In case of a permanent image swap mcuboot will never attempt to
1691 * revert the images on the next reboot. Therefore, the security
1692 * counter must be increased right after the image upgrade.
1693 */
1694 rc = boot_update_security_counter(
1695 BOOT_CURR_IMG(state),
1696 BOOT_PRIMARY_SLOT,
1697 boot_img_hdr(state, BOOT_SECONDARY_SLOT));
1698 if (rc != 0) {
1699 BOOT_LOG_ERR("Security counter update failed after "
1700 "image upgrade.");
1701 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_PANIC;
1702 }
1703 }
1704#endif /* MCUBOOT_HW_ROLLBACK_PROT */
1705
Fabio Utzige575b0b2019-09-11 12:34:23 -03001706 if (BOOT_IS_UPGRADE(swap_type)) {
Fabio Utzig12d59162019-11-28 10:01:59 -03001707 rc = swap_set_copy_done(BOOT_CURR_IMG(state));
David Vinczeba3bd602019-06-17 16:01:43 +02001708 if (rc != 0) {
Fabio Utzig10ee6482019-08-01 12:04:52 -03001709 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_PANIC;
Christopher Collinsa1c12042019-05-23 14:00:28 -07001710 }
David Vinczeba3bd602019-06-17 16:01:43 +02001711 }
1712#endif /* !MCUBOOT_OVERWRITE_ONLY */
Fabio Utzig338a19f2018-12-03 08:37:08 -02001713
David Vinczeba3bd602019-06-17 16:01:43 +02001714 return rc;
1715}
1716
1717/**
1718 * Completes a previously aborted image swap.
1719 *
1720 * @param bs The current boot status.
1721 *
1722 * @return 0 on success; nonzero on failure.
1723 */
1724#if !defined(MCUBOOT_OVERWRITE_ONLY)
1725static int
Fabio Utzig10ee6482019-08-01 12:04:52 -03001726boot_complete_partial_swap(struct boot_loader_state *state,
1727 struct boot_status *bs)
David Vinczeba3bd602019-06-17 16:01:43 +02001728{
1729 int rc;
1730
1731 /* Determine the type of swap operation being resumed from the
1732 * `swap-type` trailer field.
1733 */
Fabio Utzig10ee6482019-08-01 12:04:52 -03001734 rc = boot_swap_image(state, bs);
David Vinczeba3bd602019-06-17 16:01:43 +02001735 assert(rc == 0);
1736
Fabio Utzig10ee6482019-08-01 12:04:52 -03001737 BOOT_SWAP_TYPE(state) = bs->swap_type;
David Vinczeba3bd602019-06-17 16:01:43 +02001738
1739 /* The following states need image_ok be explicitly set after the
1740 * swap was finished to avoid a new revert.
1741 */
1742 if (bs->swap_type == BOOT_SWAP_TYPE_REVERT ||
1743 bs->swap_type == BOOT_SWAP_TYPE_PERM) {
Fabio Utzig12d59162019-11-28 10:01:59 -03001744 rc = swap_set_image_ok(BOOT_CURR_IMG(state));
David Vinczeba3bd602019-06-17 16:01:43 +02001745 if (rc != 0) {
Fabio Utzig10ee6482019-08-01 12:04:52 -03001746 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_PANIC;
David Vinczeba3bd602019-06-17 16:01:43 +02001747 }
1748 }
1749
Fabio Utzige575b0b2019-09-11 12:34:23 -03001750 if (BOOT_IS_UPGRADE(bs->swap_type)) {
Fabio Utzig12d59162019-11-28 10:01:59 -03001751 rc = swap_set_copy_done(BOOT_CURR_IMG(state));
David Vinczeba3bd602019-06-17 16:01:43 +02001752 if (rc != 0) {
Fabio Utzig10ee6482019-08-01 12:04:52 -03001753 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_PANIC;
David Vinczeba3bd602019-06-17 16:01:43 +02001754 }
1755 }
1756
Fabio Utzig10ee6482019-08-01 12:04:52 -03001757 if (BOOT_SWAP_TYPE(state) == BOOT_SWAP_TYPE_PANIC) {
David Vinczeba3bd602019-06-17 16:01:43 +02001758 BOOT_LOG_ERR("panic!");
1759 assert(0);
1760
1761 /* Loop forever... */
1762 while (1) {}
1763 }
1764
1765 return rc;
1766}
1767#endif /* !MCUBOOT_OVERWRITE_ONLY */
1768
1769#if (BOOT_IMAGE_NUMBER > 1)
1770/**
1771 * Review the validity of previously determined swap types of other images.
1772 *
1773 * @param aborted_swap The current image upgrade is a
1774 * partial/aborted swap.
1775 */
1776static void
Fabio Utzig10ee6482019-08-01 12:04:52 -03001777boot_review_image_swap_types(struct boot_loader_state *state,
1778 bool aborted_swap)
David Vinczeba3bd602019-06-17 16:01:43 +02001779{
1780 /* In that case if we rebooted in the middle of an image upgrade process, we
1781 * must review the validity of swap types, that were previously determined
1782 * for other images. The image_ok flag had not been set before the reboot
1783 * for any of the updated images (only the copy_done flag) and thus falsely
1784 * the REVERT swap type has been determined for the previous images that had
1785 * been updated before the reboot.
1786 *
1787 * There are two separate scenarios that we have to deal with:
1788 *
1789 * 1. The reboot has happened during swapping an image:
1790 * The current image upgrade has been determined as a
1791 * partial/aborted swap.
1792 * 2. The reboot has happened between two separate image upgrades:
1793 * In this scenario we must check the swap type of the current image.
1794 * In those cases if it is NONE or REVERT we cannot certainly determine
1795 * the fact of a reboot. In a consistent state images must move in the
1796 * same direction or stay in place, e.g. in practice REVERT and TEST
1797 * swap types cannot be present at the same time. If the swap type of
1798 * the current image is either TEST, PERM or FAIL we must review the
1799 * already determined swap types of other images and set each false
1800 * REVERT swap types to NONE (these images had been successfully
1801 * updated before the system rebooted between two separate image
1802 * upgrades).
1803 */
1804
Fabio Utzig10ee6482019-08-01 12:04:52 -03001805 if (BOOT_CURR_IMG(state) == 0) {
David Vinczeba3bd602019-06-17 16:01:43 +02001806 /* Nothing to do */
1807 return;
1808 }
1809
1810 if (!aborted_swap) {
Fabio Utzig10ee6482019-08-01 12:04:52 -03001811 if ((BOOT_SWAP_TYPE(state) == BOOT_SWAP_TYPE_NONE) ||
1812 (BOOT_SWAP_TYPE(state) == BOOT_SWAP_TYPE_REVERT)) {
David Vinczeba3bd602019-06-17 16:01:43 +02001813 /* Nothing to do */
1814 return;
1815 }
1816 }
1817
Fabio Utzig10ee6482019-08-01 12:04:52 -03001818 for (uint8_t i = 0; i < BOOT_CURR_IMG(state); i++) {
1819 if (state->swap_type[i] == BOOT_SWAP_TYPE_REVERT) {
1820 state->swap_type[i] = BOOT_SWAP_TYPE_NONE;
David Vinczeba3bd602019-06-17 16:01:43 +02001821 }
1822 }
1823}
1824#endif
1825
1826/**
1827 * Prepare image to be updated if required.
1828 *
1829 * Prepare image to be updated if required with completing an image swap
1830 * operation if one was aborted and/or determining the type of the
1831 * swap operation. In case of any error set the swap type to NONE.
1832 *
Fabio Utzig10ee6482019-08-01 12:04:52 -03001833 * @param state TODO
David Vinczeba3bd602019-06-17 16:01:43 +02001834 * @param bs Pointer where the read and possibly updated
1835 * boot status can be written to.
1836 */
1837static void
Fabio Utzig10ee6482019-08-01 12:04:52 -03001838boot_prepare_image_for_update(struct boot_loader_state *state,
1839 struct boot_status *bs)
David Vinczeba3bd602019-06-17 16:01:43 +02001840{
1841 int rc;
Michael Grand5047f032022-11-24 16:49:56 +01001842 FIH_DECLARE(fih_rc, FIH_FAILURE);
David Vinczeba3bd602019-06-17 16:01:43 +02001843
1844 /* Determine the sector layout of the image slots and scratch area. */
Fabio Utzig10ee6482019-08-01 12:04:52 -03001845 rc = boot_read_sectors(state);
David Vinczeba3bd602019-06-17 16:01:43 +02001846 if (rc != 0) {
1847 BOOT_LOG_WRN("Failed reading sectors; BOOT_MAX_IMG_SECTORS=%d"
1848 " - too small?", BOOT_MAX_IMG_SECTORS);
1849 /* Unable to determine sector layout, continue with next image
1850 * if there is one.
1851 */
Fabio Utzig10ee6482019-08-01 12:04:52 -03001852 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_NONE;
Andrzej Puzdrowski54b4ad92021-06-22 13:21:22 +02001853 if (rc == BOOT_EFLASH)
1854 {
1855 /* Only return on error from the primary image flash */
1856 return;
1857 }
David Vinczeba3bd602019-06-17 16:01:43 +02001858 }
1859
1860 /* Attempt to read an image header from each slot. */
Fabio Utzig12d59162019-11-28 10:01:59 -03001861 rc = boot_read_image_headers(state, false, NULL);
David Vinczeba3bd602019-06-17 16:01:43 +02001862 if (rc != 0) {
1863 /* Continue with next image if there is one. */
Fabio Utzigb0f04732019-07-31 09:49:19 -03001864 BOOT_LOG_WRN("Failed reading image headers; Image=%u",
Fabio Utzig10ee6482019-08-01 12:04:52 -03001865 BOOT_CURR_IMG(state));
1866 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_NONE;
David Vinczeba3bd602019-06-17 16:01:43 +02001867 return;
1868 }
1869
1870 /* If the current image's slots aren't compatible, no swap is possible.
1871 * Just boot into primary slot.
1872 */
Fabio Utzig10ee6482019-08-01 12:04:52 -03001873 if (boot_slots_compatible(state)) {
Fabio Utzig12d59162019-11-28 10:01:59 -03001874 boot_status_reset(bs);
1875
1876#ifndef MCUBOOT_OVERWRITE_ONLY
1877 rc = swap_read_status(state, bs);
David Vinczeba3bd602019-06-17 16:01:43 +02001878 if (rc != 0) {
1879 BOOT_LOG_WRN("Failed reading boot status; Image=%u",
Fabio Utzig10ee6482019-08-01 12:04:52 -03001880 BOOT_CURR_IMG(state));
David Vinczeba3bd602019-06-17 16:01:43 +02001881 /* Continue with next image if there is one. */
Fabio Utzig10ee6482019-08-01 12:04:52 -03001882 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_NONE;
David Vinczeba3bd602019-06-17 16:01:43 +02001883 return;
1884 }
Fabio Utzig12d59162019-11-28 10:01:59 -03001885#endif
David Vinczeba3bd602019-06-17 16:01:43 +02001886
Thomas Altenbachf515bb12024-04-26 18:31:57 +02001887#if defined(MCUBOOT_SWAP_USING_SCRATCH) || defined(MCUBOOT_SWAP_USING_MOVE)
Fabio Utzig74aef312019-11-28 11:05:34 -03001888 /*
1889 * Must re-read image headers because the boot status might
1890 * have been updated in the previous function call.
1891 */
1892 rc = boot_read_image_headers(state, !boot_status_is_reset(bs), bs);
Fabio Utzig32afe852020-10-04 10:36:02 -03001893#ifdef MCUBOOT_BOOTSTRAP
1894 /* When bootstrapping it's OK to not have image magic in the primary slot */
1895 if (rc != 0 && (BOOT_CURR_IMG(state) != BOOT_PRIMARY_SLOT ||
1896 boot_check_header_erased(state, BOOT_PRIMARY_SLOT) != 0)) {
1897#else
Fabio Utzig74aef312019-11-28 11:05:34 -03001898 if (rc != 0) {
Fabio Utzig32afe852020-10-04 10:36:02 -03001899#endif
1900
Fabio Utzig74aef312019-11-28 11:05:34 -03001901 /* Continue with next image if there is one. */
1902 BOOT_LOG_WRN("Failed reading image headers; Image=%u",
1903 BOOT_CURR_IMG(state));
1904 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_NONE;
1905 return;
1906 }
1907#endif
1908
David Vinczeba3bd602019-06-17 16:01:43 +02001909 /* Determine if we rebooted in the middle of an image swap
1910 * operation. If a partial swap was detected, complete it.
1911 */
Fabio Utzig12d59162019-11-28 10:01:59 -03001912 if (!boot_status_is_reset(bs)) {
David Vinczeba3bd602019-06-17 16:01:43 +02001913
1914#if (BOOT_IMAGE_NUMBER > 1)
Fabio Utzig10ee6482019-08-01 12:04:52 -03001915 boot_review_image_swap_types(state, true);
David Vinczeba3bd602019-06-17 16:01:43 +02001916#endif
1917
1918#ifdef MCUBOOT_OVERWRITE_ONLY
1919 /* Should never arrive here, overwrite-only mode has
1920 * no swap state.
1921 */
1922 assert(0);
1923#else
1924 /* Determine the type of swap operation being resumed from the
1925 * `swap-type` trailer field.
1926 */
Fabio Utzig10ee6482019-08-01 12:04:52 -03001927 rc = boot_complete_partial_swap(state, bs);
David Vinczeba3bd602019-06-17 16:01:43 +02001928 assert(rc == 0);
1929#endif
1930 /* Attempt to read an image header from each slot. Ensure that
1931 * image headers in slots are aligned with headers in boot_data.
1932 */
Fabio Utzig12d59162019-11-28 10:01:59 -03001933 rc = boot_read_image_headers(state, false, bs);
David Vinczeba3bd602019-06-17 16:01:43 +02001934 assert(rc == 0);
1935
1936 /* Swap has finished set to NONE */
Fabio Utzig10ee6482019-08-01 12:04:52 -03001937 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_NONE;
David Vinczeba3bd602019-06-17 16:01:43 +02001938 } else {
1939 /* There was no partial swap, determine swap type. */
1940 if (bs->swap_type == BOOT_SWAP_TYPE_NONE) {
Fabio Utzig10ee6482019-08-01 12:04:52 -03001941 BOOT_SWAP_TYPE(state) = boot_validated_swap_type(state, bs);
David Vinczeba3bd602019-06-17 16:01:43 +02001942 } else {
Raef Colese8fe6cf2020-05-26 13:07:40 +01001943 FIH_CALL(boot_validate_slot, fih_rc,
1944 state, BOOT_SECONDARY_SLOT, bs);
Michael Grand5047f032022-11-24 16:49:56 +01001945 if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
Raef Colese8fe6cf2020-05-26 13:07:40 +01001946 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_FAIL;
1947 } else {
1948 BOOT_SWAP_TYPE(state) = bs->swap_type;
1949 }
David Vinczeba3bd602019-06-17 16:01:43 +02001950 }
1951
1952#if (BOOT_IMAGE_NUMBER > 1)
Fabio Utzig10ee6482019-08-01 12:04:52 -03001953 boot_review_image_swap_types(state, false);
David Vinczeba3bd602019-06-17 16:01:43 +02001954#endif
1955
1956#ifdef MCUBOOT_BOOTSTRAP
Fabio Utzig10ee6482019-08-01 12:04:52 -03001957 if (BOOT_SWAP_TYPE(state) == BOOT_SWAP_TYPE_NONE) {
David Vinczeba3bd602019-06-17 16:01:43 +02001958 /* Header checks are done first because they are
1959 * inexpensive. Since overwrite-only copies starting from
1960 * offset 0, if interrupted, it might leave a valid header
1961 * magic, so also run validation on the primary slot to be
1962 * sure it's not OK.
1963 */
Raef Colese8fe6cf2020-05-26 13:07:40 +01001964 rc = boot_check_header_erased(state, BOOT_PRIMARY_SLOT);
1965 FIH_CALL(boot_validate_slot, fih_rc,
1966 state, BOOT_PRIMARY_SLOT, bs);
1967
Michael Grand5047f032022-11-24 16:49:56 +01001968 if (rc == 0 || FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
Raef Colese8fe6cf2020-05-26 13:07:40 +01001969
Fabio Utzig3d77c952020-10-04 10:23:17 -03001970 rc = (boot_img_hdr(state, BOOT_SECONDARY_SLOT)->ih_magic == IMAGE_MAGIC) ? 1: 0;
Raef Colese8fe6cf2020-05-26 13:07:40 +01001971 FIH_CALL(boot_validate_slot, fih_rc,
1972 state, BOOT_SECONDARY_SLOT, bs);
1973
Michael Grand5047f032022-11-24 16:49:56 +01001974 if (rc == 1 && FIH_EQ(fih_rc, FIH_SUCCESS)) {
David Vinczeba3bd602019-06-17 16:01:43 +02001975 /* Set swap type to REVERT to overwrite the primary
1976 * slot with the image contained in secondary slot
1977 * and to trigger the explicit setting of the
1978 * image_ok flag.
1979 */
Fabio Utzig59b63e52019-09-10 12:22:35 -03001980 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_REVERT;
David Vinczeba3bd602019-06-17 16:01:43 +02001981 }
Fabio Utzig338a19f2018-12-03 08:37:08 -02001982 }
1983 }
Fabio Utzig338a19f2018-12-03 08:37:08 -02001984#endif
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001985 }
David Vinczeba3bd602019-06-17 16:01:43 +02001986 } else {
1987 /* In that case if slots are not compatible. */
Fabio Utzig10ee6482019-08-01 12:04:52 -03001988 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_NONE;
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001989 }
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001990}
1991
Mark Horvathccaf7f82021-01-04 18:16:42 +01001992/**
1993 * Updates the security counter for the current image.
1994 *
1995 * @param state Boot loader status information.
1996 *
1997 * @return 0 on success; nonzero on failure.
1998 */
1999static int
2000boot_update_hw_rollback_protection(struct boot_loader_state *state)
2001{
2002#ifdef MCUBOOT_HW_ROLLBACK_PROT
2003 int rc;
2004
2005 /* Update the stored security counter with the active image's security
2006 * counter value. It will only be updated if the new security counter is
2007 * greater than the stored value.
2008 *
2009 * In case of a successful image swapping when the swap type is TEST the
2010 * security counter can be increased only after a reset, when the swap
2011 * type is NONE and the image has marked itself "OK" (the image_ok flag
2012 * has been set). This way a "revert" can be performed when it's
2013 * necessary.
2014 */
2015 if (BOOT_SWAP_TYPE(state) == BOOT_SWAP_TYPE_NONE) {
2016 rc = boot_update_security_counter(
2017 BOOT_CURR_IMG(state),
2018 BOOT_PRIMARY_SLOT,
2019 boot_img_hdr(state, BOOT_PRIMARY_SLOT));
2020 if (rc != 0) {
2021 BOOT_LOG_ERR("Security counter update failed after image "
2022 "validation.");
2023 return rc;
2024 }
2025 }
2026
2027 return 0;
2028
2029#else /* MCUBOOT_HW_ROLLBACK_PROT */
2030 (void) (state);
2031
2032 return 0;
2033#endif
2034}
2035
Jerzy Kasenberge3f895d2022-04-12 15:05:33 +02002036/**
2037 * Checks test swap downgrade prevention conditions.
2038 *
2039 * Function called only for swap upgrades test run. It may prevent
2040 * swap if slot 1 image has <= version number or < security counter
2041 *
2042 * @param state Boot loader status information.
2043 *
2044 * @return 0 - image can be swapped, -1 downgrade prevention
2045 */
2046static int
2047check_downgrade_prevention(struct boot_loader_state *state)
2048{
2049#if defined(MCUBOOT_DOWNGRADE_PREVENTION) && \
2050 (defined(MCUBOOT_SWAP_USING_MOVE) || defined(MCUBOOT_SWAP_USING_SCRATCH))
2051 uint32_t security_counter[2];
2052 int rc;
2053
2054 if (MCUBOOT_DOWNGRADE_PREVENTION_SECURITY_COUNTER) {
2055 /* If there was security no counter in slot 0, allow swap */
2056 rc = bootutil_get_img_security_cnt(&(BOOT_IMG(state, 0).hdr),
2057 BOOT_IMG(state, 0).area,
2058 &security_counter[0]);
2059 if (rc != 0) {
2060 return 0;
2061 }
2062 /* If there is no security counter in slot 1, or it's lower than
2063 * that of slot 0, prevent downgrade */
2064 rc = bootutil_get_img_security_cnt(&(BOOT_IMG(state, 1).hdr),
2065 BOOT_IMG(state, 1).area,
2066 &security_counter[1]);
2067 if (rc != 0 || security_counter[0] > security_counter[1]) {
2068 rc = -1;
2069 }
2070 }
2071 else {
2072 rc = boot_version_cmp(&boot_img_hdr(state, BOOT_SECONDARY_SLOT)->ih_ver,
2073 &boot_img_hdr(state, BOOT_PRIMARY_SLOT)->ih_ver);
2074 }
2075 if (rc < 0) {
2076 /* Image in slot 0 prevents downgrade, delete image in slot 1 */
Antonio de Angelis48547002023-04-14 09:47:09 +01002077 BOOT_LOG_INF("Image %d in slot 1 erased due to downgrade prevention", BOOT_CURR_IMG(state));
Jerzy Kasenberge3f895d2022-04-12 15:05:33 +02002078 flash_area_erase(BOOT_IMG(state, 1).area, 0,
2079 flash_area_get_size(BOOT_IMG(state, 1).area));
2080 } else {
2081 rc = 0;
2082 }
2083 return rc;
2084#else
2085 (void)state;
2086 return 0;
2087#endif
2088}
2089
Michael Grand5047f032022-11-24 16:49:56 +01002090fih_ret
Fabio Utzig10ee6482019-08-01 12:04:52 -03002091context_boot_go(struct boot_loader_state *state, struct boot_rsp *rsp)
Christopher Collins92ea77f2016-12-12 15:59:26 -08002092{
Marti Bolivar84898652017-06-13 17:20:22 -04002093 size_t slot;
David Vinczeba3bd602019-06-17 16:01:43 +02002094 struct boot_status bs;
David Vincze9015a5d2020-05-18 14:43:11 +02002095 int rc = -1;
Michael Grand5047f032022-11-24 16:49:56 +01002096 FIH_DECLARE(fih_rc, FIH_FAILURE);
Marti Bolivarc0b47912017-06-13 17:18:09 -04002097 int fa_id;
Fabio Utzigb0f04732019-07-31 09:49:19 -03002098 int image_index;
Fabio Utzig298913b2019-08-28 11:22:45 -03002099 bool has_upgrade;
Michael Grand5047f032022-11-24 16:49:56 +01002100 volatile int fih_cnt;
Christopher Collins92ea77f2016-12-12 15:59:26 -08002101
2102 /* The array of slot sectors are defined here (as opposed to file scope) so
2103 * that they don't get allocated for non-boot-loader apps. This is
2104 * necessary because the gcc option "-fdata-sections" doesn't seem to have
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08002105 * any effect in older gcc versions (e.g., 4.8.4).
Christopher Collins92ea77f2016-12-12 15:59:26 -08002106 */
Fabio Utzig10ee6482019-08-01 12:04:52 -03002107 TARGET_STATIC boot_sector_t primary_slot_sectors[BOOT_IMAGE_NUMBER][BOOT_MAX_IMG_SECTORS];
2108 TARGET_STATIC boot_sector_t secondary_slot_sectors[BOOT_IMAGE_NUMBER][BOOT_MAX_IMG_SECTORS];
Fabio Utzig12d59162019-11-28 10:01:59 -03002109#if MCUBOOT_SWAP_USING_SCRATCH
Fabio Utzig10ee6482019-08-01 12:04:52 -03002110 TARGET_STATIC boot_sector_t scratch_sectors[BOOT_MAX_IMG_SECTORS];
Fabio Utzig12d59162019-11-28 10:01:59 -03002111#endif
Christopher Collins92ea77f2016-12-12 15:59:26 -08002112
Fabio Utzig298913b2019-08-28 11:22:45 -03002113 has_upgrade = false;
2114
2115#if (BOOT_IMAGE_NUMBER == 1)
2116 (void)has_upgrade;
2117#endif
Fabio Utzigba829042018-09-18 08:29:34 -03002118
David Vinczeba3bd602019-06-17 16:01:43 +02002119 /* Iterate over all the images. By the end of the loop the swap type has
2120 * to be determined for each image and all aborted swaps have to be
2121 * completed.
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08002122 */
Fabio Utzig10ee6482019-08-01 12:04:52 -03002123 IMAGES_ITER(BOOT_CURR_IMG(state)) {
Raef Colesf11de642021-10-15 11:11:56 +01002124#if BOOT_IMAGE_NUMBER > 1
2125 if (state->img_mask[BOOT_CURR_IMG(state)]) {
2126 continue;
2127 }
2128#endif
David Vinczeba3bd602019-06-17 16:01:43 +02002129#if defined(MCUBOOT_ENC_IMAGES) && (BOOT_IMAGE_NUMBER > 1)
2130 /* The keys used for encryption may no longer be valid (could belong to
2131 * another images). Therefore, mark them as invalid to force their reload
2132 * by boot_enc_load().
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03002133 */
Fabio Utzig1e4284b2019-08-23 11:55:27 -03002134 boot_enc_zeroize(BOOT_CURR_ENC(state));
David Brown554c52e2017-06-30 16:01:07 -06002135#endif
2136
Fabio Utzig10ee6482019-08-01 12:04:52 -03002137 image_index = BOOT_CURR_IMG(state);
Fabio Utzigb0f04732019-07-31 09:49:19 -03002138
Fabio Utzig10ee6482019-08-01 12:04:52 -03002139 BOOT_IMG(state, BOOT_PRIMARY_SLOT).sectors =
Fabio Utzigb0f04732019-07-31 09:49:19 -03002140 primary_slot_sectors[image_index];
Fabio Utzig10ee6482019-08-01 12:04:52 -03002141 BOOT_IMG(state, BOOT_SECONDARY_SLOT).sectors =
Fabio Utzigb0f04732019-07-31 09:49:19 -03002142 secondary_slot_sectors[image_index];
Fabio Utzig12d59162019-11-28 10:01:59 -03002143#if MCUBOOT_SWAP_USING_SCRATCH
Fabio Utzig10ee6482019-08-01 12:04:52 -03002144 state->scratch.sectors = scratch_sectors;
Fabio Utzig12d59162019-11-28 10:01:59 -03002145#endif
David Vinczeba3bd602019-06-17 16:01:43 +02002146
2147 /* Open primary and secondary image areas for the duration
2148 * of this call.
2149 */
2150 for (slot = 0; slot < BOOT_NUM_SLOTS; slot++) {
Fabio Utzigb0f04732019-07-31 09:49:19 -03002151 fa_id = flash_area_id_from_multi_image_slot(image_index, slot);
Fabio Utzig10ee6482019-08-01 12:04:52 -03002152 rc = flash_area_open(fa_id, &BOOT_IMG_AREA(state, slot));
David Vinczeba3bd602019-06-17 16:01:43 +02002153 assert(rc == 0);
Jamie McCrae2929a972023-09-25 11:12:20 +01002154
2155 if (rc != 0) {
2156 BOOT_LOG_ERR("Failed to open flash area ID %d (image %d slot %d): %d, "
2157 "cannot continue", fa_id, image_index, (int8_t)slot, rc);
2158 FIH_PANIC;
2159 }
David Vinczeba3bd602019-06-17 16:01:43 +02002160 }
Fabio Utzig12d59162019-11-28 10:01:59 -03002161#if MCUBOOT_SWAP_USING_SCRATCH
David Vinczeba3bd602019-06-17 16:01:43 +02002162 rc = flash_area_open(FLASH_AREA_IMAGE_SCRATCH,
Fabio Utzig10ee6482019-08-01 12:04:52 -03002163 &BOOT_SCRATCH_AREA(state));
David Vinczeba3bd602019-06-17 16:01:43 +02002164 assert(rc == 0);
Jamie McCrae2929a972023-09-25 11:12:20 +01002165
2166 if (rc != 0) {
2167 BOOT_LOG_ERR("Failed to open scratch flash area: %d, cannot continue", rc);
2168 FIH_PANIC;
2169 }
Fabio Utzig12d59162019-11-28 10:01:59 -03002170#endif
David Vinczeba3bd602019-06-17 16:01:43 +02002171
2172 /* Determine swap type and complete swap if it has been aborted. */
Fabio Utzig10ee6482019-08-01 12:04:52 -03002173 boot_prepare_image_for_update(state, &bs);
Fabio Utzig298913b2019-08-28 11:22:45 -03002174
Fabio Utzige575b0b2019-09-11 12:34:23 -03002175 if (BOOT_IS_UPGRADE(BOOT_SWAP_TYPE(state))) {
Fabio Utzig298913b2019-08-28 11:22:45 -03002176 has_upgrade = true;
2177 }
David Vinczeba3bd602019-06-17 16:01:43 +02002178 }
2179
David Vinczee32483f2019-06-13 10:46:24 +02002180#if (BOOT_IMAGE_NUMBER > 1)
Fabio Utzig298913b2019-08-28 11:22:45 -03002181 if (has_upgrade) {
2182 /* Iterate over all the images and verify whether the image dependencies
2183 * are all satisfied and update swap type if necessary.
2184 */
2185 rc = boot_verify_dependencies(state);
David Vincze8b0b6372020-05-20 19:54:44 +02002186 if (rc != 0) {
Fabio Utzig298913b2019-08-28 11:22:45 -03002187 /*
2188 * It was impossible to upgrade because the expected dependency version
2189 * was not available. Here we already changed the swap_type so that
2190 * instead of asserting the bootloader, we continue and no upgrade is
2191 * performed.
2192 */
2193 rc = 0;
2194 }
2195 }
David Vinczee32483f2019-06-13 10:46:24 +02002196#endif
2197
Jamie McCrae56cb6102022-03-23 11:57:03 +00002198 /* Trigger status change callback with upgrading status */
2199 mcuboot_status_change(MCUBOOT_STATUS_UPGRADING);
2200
David Vinczeba3bd602019-06-17 16:01:43 +02002201 /* Iterate over all the images. At this point there are no aborted swaps
2202 * and the swap types are determined for each image. By the end of the loop
2203 * all required update operations will have been finished.
2204 */
Fabio Utzig10ee6482019-08-01 12:04:52 -03002205 IMAGES_ITER(BOOT_CURR_IMG(state)) {
David Vinczeba3bd602019-06-17 16:01:43 +02002206#if (BOOT_IMAGE_NUMBER > 1)
Raef Colesf11de642021-10-15 11:11:56 +01002207 if (state->img_mask[BOOT_CURR_IMG(state)]) {
2208 continue;
2209 }
2210
David Vinczeba3bd602019-06-17 16:01:43 +02002211#ifdef MCUBOOT_ENC_IMAGES
2212 /* The keys used for encryption may no longer be valid (could belong to
2213 * another images). Therefore, mark them as invalid to force their reload
2214 * by boot_enc_load().
2215 */
Fabio Utzig1e4284b2019-08-23 11:55:27 -03002216 boot_enc_zeroize(BOOT_CURR_ENC(state));
David Vinczeba3bd602019-06-17 16:01:43 +02002217#endif /* MCUBOOT_ENC_IMAGES */
2218
2219 /* Indicate that swap is not aborted */
Fabio Utzig12d59162019-11-28 10:01:59 -03002220 boot_status_reset(&bs);
David Vinczeba3bd602019-06-17 16:01:43 +02002221#endif /* (BOOT_IMAGE_NUMBER > 1) */
2222
2223 /* Set the previously determined swap type */
Fabio Utzig10ee6482019-08-01 12:04:52 -03002224 bs.swap_type = BOOT_SWAP_TYPE(state);
David Vinczeba3bd602019-06-17 16:01:43 +02002225
Fabio Utzig10ee6482019-08-01 12:04:52 -03002226 switch (BOOT_SWAP_TYPE(state)) {
David Vinczeba3bd602019-06-17 16:01:43 +02002227 case BOOT_SWAP_TYPE_NONE:
2228 break;
2229
Jerzy Kasenberge3f895d2022-04-12 15:05:33 +02002230 case BOOT_SWAP_TYPE_TEST:
Michael Grand99613c62023-06-20 15:01:00 +02002231 /* fallthrough */
2232 case BOOT_SWAP_TYPE_PERM:
Jerzy Kasenberge3f895d2022-04-12 15:05:33 +02002233 if (check_downgrade_prevention(state) != 0) {
2234 /* Downgrade prevented */
2235 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_NONE;
2236 break;
2237 }
2238 /* fallthrough */
David Vinczeba3bd602019-06-17 16:01:43 +02002239 case BOOT_SWAP_TYPE_REVERT:
Andrzej Puzdrowskib8f39692021-07-02 15:05:37 +02002240 rc = BOOT_HOOK_CALL(boot_perform_update_hook, BOOT_HOOK_REGULAR,
2241 BOOT_CURR_IMG(state), &(BOOT_IMG(state, 1).hdr),
2242 BOOT_IMG_AREA(state, BOOT_SECONDARY_SLOT));
2243 if (rc == BOOT_HOOK_REGULAR)
2244 {
2245 rc = boot_perform_update(state, &bs);
2246 }
David Vinczeba3bd602019-06-17 16:01:43 +02002247 assert(rc == 0);
2248 break;
2249
2250 case BOOT_SWAP_TYPE_FAIL:
2251 /* The image in secondary slot was invalid and is now erased. Ensure
2252 * we don't try to boot into it again on the next reboot. Do this by
2253 * pretending we just reverted back to primary slot.
2254 */
2255#ifndef MCUBOOT_OVERWRITE_ONLY
2256 /* image_ok needs to be explicitly set to avoid a new revert. */
Fabio Utzig12d59162019-11-28 10:01:59 -03002257 rc = swap_set_image_ok(BOOT_CURR_IMG(state));
David Vinczeba3bd602019-06-17 16:01:43 +02002258 if (rc != 0) {
Fabio Utzig10ee6482019-08-01 12:04:52 -03002259 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_PANIC;
David Vinczeba3bd602019-06-17 16:01:43 +02002260 }
2261#endif /* !MCUBOOT_OVERWRITE_ONLY */
2262 break;
2263
2264 default:
Fabio Utzig10ee6482019-08-01 12:04:52 -03002265 BOOT_SWAP_TYPE(state) = BOOT_SWAP_TYPE_PANIC;
David Vinczeba3bd602019-06-17 16:01:43 +02002266 }
2267
Fabio Utzig10ee6482019-08-01 12:04:52 -03002268 if (BOOT_SWAP_TYPE(state) == BOOT_SWAP_TYPE_PANIC) {
David Vinczeba3bd602019-06-17 16:01:43 +02002269 BOOT_LOG_ERR("panic!");
2270 assert(0);
2271
2272 /* Loop forever... */
Raef Colese8fe6cf2020-05-26 13:07:40 +01002273 FIH_PANIC;
David Vinczeba3bd602019-06-17 16:01:43 +02002274 }
2275 }
2276
2277 /* Iterate over all the images. At this point all required update operations
2278 * have finished. By the end of the loop each image in the primary slot will
2279 * have been re-validated.
2280 */
Michael Grand5047f032022-11-24 16:49:56 +01002281 FIH_SET(fih_cnt, 0);
Fabio Utzig10ee6482019-08-01 12:04:52 -03002282 IMAGES_ITER(BOOT_CURR_IMG(state)) {
Raef Colesf11de642021-10-15 11:11:56 +01002283#if BOOT_IMAGE_NUMBER > 1
Michael Grand5047f032022-11-24 16:49:56 +01002284 /* Hardenned to prevent from skipping check of a given image,
2285 * tmp_img_mask is declared volatile
2286 */
2287 volatile bool tmp_img_mask;
2288 FIH_SET(tmp_img_mask, state->img_mask[BOOT_CURR_IMG(state)]);
2289 if (FIH_EQ(tmp_img_mask, true)) {
2290 ++fih_cnt;
Raef Colesf11de642021-10-15 11:11:56 +01002291 continue;
2292 }
2293#endif
Fabio Utzig10ee6482019-08-01 12:04:52 -03002294 if (BOOT_SWAP_TYPE(state) != BOOT_SWAP_TYPE_NONE) {
David Vinczeba3bd602019-06-17 16:01:43 +02002295 /* Attempt to read an image header from each slot. Ensure that image
2296 * headers in slots are aligned with headers in boot_data.
Dominik Ermel6f7f8732024-02-01 11:59:24 +00002297 * Note: Quite complicated internal logic of boot_read_image_headers
2298 * uses boot state, the last parm, to figure out in which slot which
2299 * header is located; when boot state is not provided, then it
2300 * is assumed that headers are at proper slots (we are not in
2301 * the middle of moving images, etc).
David Vinczeba3bd602019-06-17 16:01:43 +02002302 */
Dominik Ermel6f7f8732024-02-01 11:59:24 +00002303 rc = boot_read_image_headers(state, false, NULL);
David Vinczeba3bd602019-06-17 16:01:43 +02002304 if (rc != 0) {
Michael Grand5047f032022-11-24 16:49:56 +01002305 FIH_SET(fih_rc, FIH_FAILURE);
David Vinczeba3bd602019-06-17 16:01:43 +02002306 goto out;
2307 }
2308 /* Since headers were reloaded, it can be assumed we just performed
2309 * a swap or overwrite. Now the header info that should be used to
2310 * provide the data for the bootstrap, which previously was at
2311 * secondary slot, was updated to primary slot.
2312 */
2313 }
2314
2315#ifdef MCUBOOT_VALIDATE_PRIMARY_SLOT
Raef Colese8fe6cf2020-05-26 13:07:40 +01002316 FIH_CALL(boot_validate_slot, fih_rc, state, BOOT_PRIMARY_SLOT, NULL);
Michael Grand5047f032022-11-24 16:49:56 +01002317 /* Check for all possible values is redundant in normal operation it
2318 * is meant to prevent FI attack.
2319 */
2320 if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS) ||
2321 FIH_EQ(fih_rc, FIH_FAILURE) ||
2322 FIH_EQ(fih_rc, FIH_NO_BOOTABLE_IMAGE)) {
2323 FIH_SET(fih_rc, FIH_FAILURE);
David Vinczeba3bd602019-06-17 16:01:43 +02002324 goto out;
2325 }
2326#else
2327 /* Even if we're not re-validating the primary slot, we could be booting
2328 * onto an empty flash chip. At least do a basic sanity check that
2329 * the magic number on the image is OK.
2330 */
Fabio Utzig10ee6482019-08-01 12:04:52 -03002331 if (BOOT_IMG(state, BOOT_PRIMARY_SLOT).hdr.ih_magic != IMAGE_MAGIC) {
David Vinczeba3bd602019-06-17 16:01:43 +02002332 BOOT_LOG_ERR("bad image magic 0x%lx; Image=%u", (unsigned long)
Dominik Ermel4a4d1ac2021-08-06 11:23:52 +00002333 BOOT_IMG(state, BOOT_PRIMARY_SLOT).hdr.ih_magic,
Fabio Utzig10ee6482019-08-01 12:04:52 -03002334 BOOT_CURR_IMG(state));
David Vinczeba3bd602019-06-17 16:01:43 +02002335 rc = BOOT_EBADIMAGE;
Michael Grand5047f032022-11-24 16:49:56 +01002336 FIH_SET(fih_rc, FIH_FAILURE);
David Vinczeba3bd602019-06-17 16:01:43 +02002337 goto out;
2338 }
David Vinczec3084132020-02-18 14:50:47 +01002339#endif /* MCUBOOT_VALIDATE_PRIMARY_SLOT */
2340
Mark Horvathccaf7f82021-01-04 18:16:42 +01002341 rc = boot_update_hw_rollback_protection(state);
David Vincze1cf11b52020-03-24 07:51:09 +01002342 if (rc != 0) {
Michael Grand5047f032022-11-24 16:49:56 +01002343 FIH_SET(fih_rc, FIH_FAILURE);
Raef Colese8fe6cf2020-05-26 13:07:40 +01002344 goto out;
David Vincze1cf11b52020-03-24 07:51:09 +01002345 }
David Vincze1cf11b52020-03-24 07:51:09 +01002346
Mark Horvathccaf7f82021-01-04 18:16:42 +01002347 rc = boot_add_shared_data(state, BOOT_PRIMARY_SLOT);
David Vincze1cf11b52020-03-24 07:51:09 +01002348 if (rc != 0) {
Michael Grand5047f032022-11-24 16:49:56 +01002349 FIH_SET(fih_rc, FIH_FAILURE);
Raef Colese8fe6cf2020-05-26 13:07:40 +01002350 goto out;
David Vincze1cf11b52020-03-24 07:51:09 +01002351 }
Michael Grand5047f032022-11-24 16:49:56 +01002352 ++fih_cnt;
David Vinczeba3bd602019-06-17 16:01:43 +02002353 }
Michael Grand5047f032022-11-24 16:49:56 +01002354 /*
2355 * fih_cnt should be equal to BOOT_IMAGE_NUMBER now.
2356 * If this is not the case, at least one iteration of the loop
2357 * has been skipped.
2358 */
2359 if(FIH_NOT_EQ(fih_cnt, BOOT_IMAGE_NUMBER)) {
2360 FIH_PANIC;
2361 }
Fabio Utzigf616c542019-12-19 15:23:32 -03002362
Raef Colesfe57e7d2021-10-15 11:07:09 +01002363 fill_rsp(state, rsp);
Christopher Collins92ea77f2016-12-12 15:59:26 -08002364
Raef Colese8fe6cf2020-05-26 13:07:40 +01002365 fih_rc = FIH_SUCCESS;
Fabio Utzig298913b2019-08-28 11:22:45 -03002366out:
Dominik Ermel256bc372022-12-07 15:51:31 +00002367 /*
2368 * Since the boot_status struct stores plaintext encryption keys, reset
2369 * them here to avoid the possibility of jumping into an image that could
2370 * easily recover them.
2371 */
2372#if defined(MCUBOOT_ENC_IMAGES) || defined(MCUBOOT_SWAP_SAVE_ENCTLV)
2373 like_mbedtls_zeroize(&bs, sizeof(bs));
2374#else
2375 memset(&bs, 0, sizeof(struct boot_status));
2376#endif
2377
Mark Horvathccaf7f82021-01-04 18:16:42 +01002378 close_all_flash_areas(state);
Raef Colese8fe6cf2020-05-26 13:07:40 +01002379 FIH_RET(fih_rc);
Christopher Collins92ea77f2016-12-12 15:59:26 -08002380}
2381
Michael Grand5047f032022-11-24 16:49:56 +01002382fih_ret
Christopher Collins92ea77f2016-12-12 15:59:26 -08002383split_go(int loader_slot, int split_slot, void **entry)
2384{
Marti Bolivarc50926f2017-06-14 09:35:40 -04002385 boot_sector_t *sectors;
Christopher Collins034a6202017-01-11 12:19:37 -08002386 uintptr_t entry_val;
Christopher Collins92ea77f2016-12-12 15:59:26 -08002387 int loader_flash_id;
Marti Bolivarc0b47912017-06-13 17:18:09 -04002388 int split_flash_id;
Christopher Collins92ea77f2016-12-12 15:59:26 -08002389 int rc;
Michael Grand5047f032022-11-24 16:49:56 +01002390 FIH_DECLARE(fih_rc, FIH_FAILURE);
Christopher Collins92ea77f2016-12-12 15:59:26 -08002391
Christopher Collins92ea77f2016-12-12 15:59:26 -08002392 sectors = malloc(BOOT_MAX_IMG_SECTORS * 2 * sizeof *sectors);
2393 if (sectors == NULL) {
Raef Colese8fe6cf2020-05-26 13:07:40 +01002394 FIH_RET(FIH_FAILURE);
Christopher Collins92ea77f2016-12-12 15:59:26 -08002395 }
David Vinczeba3bd602019-06-17 16:01:43 +02002396 BOOT_IMG(&boot_data, loader_slot).sectors = sectors + 0;
2397 BOOT_IMG(&boot_data, split_slot).sectors = sectors + BOOT_MAX_IMG_SECTORS;
Marti Bolivarc0b47912017-06-13 17:18:09 -04002398
2399 loader_flash_id = flash_area_id_from_image_slot(loader_slot);
2400 rc = flash_area_open(loader_flash_id,
Alvaro Prieto63a2bdb2019-07-04 12:18:49 -07002401 &BOOT_IMG_AREA(&boot_data, loader_slot));
Marti Bolivarc0b47912017-06-13 17:18:09 -04002402 assert(rc == 0);
2403 split_flash_id = flash_area_id_from_image_slot(split_slot);
2404 rc = flash_area_open(split_flash_id,
2405 &BOOT_IMG_AREA(&boot_data, split_slot));
2406 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -08002407
2408 /* Determine the sector layout of the image slots and scratch area. */
Fabio Utzig10ee6482019-08-01 12:04:52 -03002409 rc = boot_read_sectors(&boot_data);
Christopher Collins92ea77f2016-12-12 15:59:26 -08002410 if (rc != 0) {
2411 rc = SPLIT_GO_ERR;
2412 goto done;
2413 }
2414
Fabio Utzig12d59162019-11-28 10:01:59 -03002415 rc = boot_read_image_headers(&boot_data, true, NULL);
Christopher Collins92ea77f2016-12-12 15:59:26 -08002416 if (rc != 0) {
2417 goto done;
2418 }
2419
Christopher Collins92ea77f2016-12-12 15:59:26 -08002420 /* Don't check the bootable image flag because we could really call a
2421 * bootable or non-bootable image. Just validate that the image check
2422 * passes which is distinct from the normal check.
2423 */
Raef Colese8fe6cf2020-05-26 13:07:40 +01002424 FIH_CALL(split_image_check, fih_rc,
2425 boot_img_hdr(&boot_data, split_slot),
2426 BOOT_IMG_AREA(&boot_data, split_slot),
2427 boot_img_hdr(&boot_data, loader_slot),
2428 BOOT_IMG_AREA(&boot_data, loader_slot));
Michael Grand5047f032022-11-24 16:49:56 +01002429 if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
Christopher Collins92ea77f2016-12-12 15:59:26 -08002430 goto done;
2431 }
2432
Marti Bolivarea088872017-06-12 17:10:49 -04002433 entry_val = boot_img_slot_off(&boot_data, split_slot) +
Marti Bolivarf804f622017-06-12 15:41:48 -04002434 boot_img_hdr(&boot_data, split_slot)->ih_hdr_size;
Christopher Collins034a6202017-01-11 12:19:37 -08002435 *entry = (void *) entry_val;
Christopher Collins92ea77f2016-12-12 15:59:26 -08002436 rc = SPLIT_GO_OK;
2437
2438done:
Marti Bolivarc0b47912017-06-13 17:18:09 -04002439 flash_area_close(BOOT_IMG_AREA(&boot_data, split_slot));
2440 flash_area_close(BOOT_IMG_AREA(&boot_data, loader_slot));
Christopher Collins92ea77f2016-12-12 15:59:26 -08002441 free(sectors);
Raef Colese8fe6cf2020-05-26 13:07:40 +01002442
2443 if (rc) {
Michael Grand5047f032022-11-24 16:49:56 +01002444 FIH_SET(fih_rc, FIH_FAILURE);
Raef Colese8fe6cf2020-05-26 13:07:40 +01002445 }
2446
2447 FIH_RET(fih_rc);
Christopher Collins92ea77f2016-12-12 15:59:26 -08002448}
David Vinczee574f2d2020-07-10 11:42:03 +02002449
Tamas Banfe031092020-09-10 17:32:39 +02002450#else /* MCUBOOT_DIRECT_XIP || MCUBOOT_RAM_LOAD */
David Vinczee574f2d2020-07-10 11:42:03 +02002451
2452/**
Mark Horvathccaf7f82021-01-04 18:16:42 +01002453 * Opens all flash areas and checks which contain an image with a valid header.
David Vinczee574f2d2020-07-10 11:42:03 +02002454 *
Mark Horvathccaf7f82021-01-04 18:16:42 +01002455 * @param state Boot loader status information.
David Vinczee574f2d2020-07-10 11:42:03 +02002456 *
Mark Horvathccaf7f82021-01-04 18:16:42 +01002457 * @return 0 on success; nonzero on failure.
2458 */
2459static int
Raef Colesfe57e7d2021-10-15 11:07:09 +01002460boot_get_slot_usage(struct boot_loader_state *state)
Mark Horvathccaf7f82021-01-04 18:16:42 +01002461{
2462 uint32_t slot;
2463 int fa_id;
2464 int rc;
2465 struct image_header *hdr = NULL;
2466
2467 IMAGES_ITER(BOOT_CURR_IMG(state)) {
Raef Colesf11de642021-10-15 11:11:56 +01002468#if BOOT_IMAGE_NUMBER > 1
2469 if (state->img_mask[BOOT_CURR_IMG(state)]) {
2470 continue;
2471 }
2472#endif
Mark Horvathccaf7f82021-01-04 18:16:42 +01002473 /* Open all the slots */
2474 for (slot = 0; slot < BOOT_NUM_SLOTS; slot++) {
2475 fa_id = flash_area_id_from_multi_image_slot(
2476 BOOT_CURR_IMG(state), slot);
2477 rc = flash_area_open(fa_id, &BOOT_IMG_AREA(state, slot));
2478 assert(rc == 0);
2479 }
2480
2481 /* Attempt to read an image header from each slot. */
2482 rc = boot_read_image_headers(state, false, NULL);
2483 if (rc != 0) {
2484 BOOT_LOG_WRN("Failed reading image headers.");
2485 return rc;
2486 }
2487
2488 /* Check headers in all slots */
2489 for (slot = 0; slot < BOOT_NUM_SLOTS; slot++) {
2490 hdr = boot_img_hdr(state, slot);
2491
2492 if (boot_is_header_valid(hdr, BOOT_IMG_AREA(state, slot))) {
Raef Colesfe57e7d2021-10-15 11:07:09 +01002493 state->slot_usage[BOOT_CURR_IMG(state)].slot_available[slot] = true;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002494 BOOT_LOG_IMAGE_INFO(slot, hdr);
2495 } else {
Raef Colesfe57e7d2021-10-15 11:07:09 +01002496 state->slot_usage[BOOT_CURR_IMG(state)].slot_available[slot] = false;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002497 BOOT_LOG_INF("Image %d %s slot: Image not found",
2498 BOOT_CURR_IMG(state),
2499 (slot == BOOT_PRIMARY_SLOT)
2500 ? "Primary" : "Secondary");
2501 }
2502 }
2503
Raef Colesfe57e7d2021-10-15 11:07:09 +01002504 state->slot_usage[BOOT_CURR_IMG(state)].active_slot = NO_ACTIVE_SLOT;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002505 }
2506
2507 return 0;
2508}
2509
2510/**
2511 * Finds the slot containing the image with the highest version number for the
2512 * current image.
2513 *
2514 * @param state Boot loader status information.
Mark Horvathccaf7f82021-01-04 18:16:42 +01002515 *
2516 * @return NO_ACTIVE_SLOT if no available slot found, number of
2517 * the found slot otherwise.
David Vinczee574f2d2020-07-10 11:42:03 +02002518 */
2519static uint32_t
Raef Colesfe57e7d2021-10-15 11:07:09 +01002520find_slot_with_highest_version(struct boot_loader_state *state)
David Vinczee574f2d2020-07-10 11:42:03 +02002521{
David Vinczee574f2d2020-07-10 11:42:03 +02002522 uint32_t slot;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002523 uint32_t candidate_slot = NO_ACTIVE_SLOT;
2524 int rc;
David Vinczee574f2d2020-07-10 11:42:03 +02002525
Mark Horvathccaf7f82021-01-04 18:16:42 +01002526 for (slot = 0; slot < BOOT_NUM_SLOTS; slot++) {
Raef Colesfe57e7d2021-10-15 11:07:09 +01002527 if (state->slot_usage[BOOT_CURR_IMG(state)].slot_available[slot]) {
Mark Horvathccaf7f82021-01-04 18:16:42 +01002528 if (candidate_slot == NO_ACTIVE_SLOT) {
2529 candidate_slot = slot;
2530 } else {
2531 rc = boot_version_cmp(
2532 &boot_img_hdr(state, slot)->ih_ver,
2533 &boot_img_hdr(state, candidate_slot)->ih_ver);
2534 if (rc == 1) {
2535 /* The version of the image being examined is greater than
2536 * the version of the current candidate.
2537 */
2538 candidate_slot = slot;
2539 }
2540 }
David Vinczee574f2d2020-07-10 11:42:03 +02002541 }
2542 }
2543
Mark Horvathccaf7f82021-01-04 18:16:42 +01002544 return candidate_slot;
David Vinczee574f2d2020-07-10 11:42:03 +02002545}
2546
Mark Horvathccaf7f82021-01-04 18:16:42 +01002547#ifdef MCUBOOT_HAVE_LOGGING
2548/**
2549 * Prints the state of the loaded images.
2550 *
2551 * @param state Boot loader status information.
Mark Horvathccaf7f82021-01-04 18:16:42 +01002552 */
2553static void
Raef Colesfe57e7d2021-10-15 11:07:09 +01002554print_loaded_images(struct boot_loader_state *state)
Mark Horvathccaf7f82021-01-04 18:16:42 +01002555{
2556 uint32_t active_slot;
2557
David Brown695e5912021-05-24 16:58:01 -06002558 (void)state;
2559
Mark Horvathccaf7f82021-01-04 18:16:42 +01002560 IMAGES_ITER(BOOT_CURR_IMG(state)) {
Raef Colesf11de642021-10-15 11:11:56 +01002561#if BOOT_IMAGE_NUMBER > 1
2562 if (state->img_mask[BOOT_CURR_IMG(state)]) {
2563 continue;
2564 }
2565#endif
Raef Colesfe57e7d2021-10-15 11:07:09 +01002566 active_slot = state->slot_usage[BOOT_CURR_IMG(state)].active_slot;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002567
2568 BOOT_LOG_INF("Image %d loaded from the %s slot",
2569 BOOT_CURR_IMG(state),
2570 (active_slot == BOOT_PRIMARY_SLOT) ?
2571 "primary" : "secondary");
2572 }
2573}
2574#endif
2575
David Vincze1c456242021-06-29 15:25:24 +02002576#if defined(MCUBOOT_DIRECT_XIP) && defined(MCUBOOT_DIRECT_XIP_REVERT)
David Vincze505fba22020-10-22 13:53:29 +02002577/**
Mark Horvathccaf7f82021-01-04 18:16:42 +01002578 * Checks whether the active slot of the current image was previously selected
2579 * to run. Erases the image if it was selected but its execution failed,
2580 * otherwise marks it as selected if it has not been before.
David Vincze505fba22020-10-22 13:53:29 +02002581 *
Mark Horvathccaf7f82021-01-04 18:16:42 +01002582 * @param state Boot loader status information.
David Vincze505fba22020-10-22 13:53:29 +02002583 *
Mark Horvathccaf7f82021-01-04 18:16:42 +01002584 * @return 0 on success; nonzero on failure.
David Vincze505fba22020-10-22 13:53:29 +02002585 */
2586static int
Raef Colesfe57e7d2021-10-15 11:07:09 +01002587boot_select_or_erase(struct boot_loader_state *state)
David Vincze505fba22020-10-22 13:53:29 +02002588{
2589 const struct flash_area *fap;
2590 int fa_id;
2591 int rc;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002592 uint32_t active_slot;
2593 struct boot_swap_state* active_swap_state;
David Vincze505fba22020-10-22 13:53:29 +02002594
Raef Colesfe57e7d2021-10-15 11:07:09 +01002595 active_slot = state->slot_usage[BOOT_CURR_IMG(state)].active_slot;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002596
2597 fa_id = flash_area_id_from_multi_image_slot(BOOT_CURR_IMG(state), active_slot);
David Vincze505fba22020-10-22 13:53:29 +02002598 rc = flash_area_open(fa_id, &fap);
2599 assert(rc == 0);
2600
Raef Colesfe57e7d2021-10-15 11:07:09 +01002601 active_swap_state = &(state->slot_usage[BOOT_CURR_IMG(state)].swap_state);
Mark Horvathccaf7f82021-01-04 18:16:42 +01002602
2603 memset(active_swap_state, 0, sizeof(struct boot_swap_state));
2604 rc = boot_read_swap_state(fap, active_swap_state);
David Vincze505fba22020-10-22 13:53:29 +02002605 assert(rc == 0);
2606
Mark Horvathccaf7f82021-01-04 18:16:42 +01002607 if (active_swap_state->magic != BOOT_MAGIC_GOOD ||
2608 (active_swap_state->copy_done == BOOT_FLAG_SET &&
2609 active_swap_state->image_ok != BOOT_FLAG_SET)) {
David Vincze505fba22020-10-22 13:53:29 +02002610 /*
2611 * A reboot happened without the image being confirmed at
2612 * runtime or its trailer is corrupted/invalid. Erase the image
2613 * to prevent it from being selected again on the next reboot.
2614 */
2615 BOOT_LOG_DBG("Erasing faulty image in the %s slot.",
Carlos Falgueras Garcíaae13c3c2021-06-21 17:20:31 +02002616 (active_slot == BOOT_PRIMARY_SLOT) ? "primary" : "secondary");
Dominik Ermel260ae092021-04-23 05:38:45 +00002617 rc = flash_area_erase(fap, 0, flash_area_get_size(fap));
David Vincze505fba22020-10-22 13:53:29 +02002618 assert(rc == 0);
2619
2620 flash_area_close(fap);
2621 rc = -1;
2622 } else {
Mark Horvathccaf7f82021-01-04 18:16:42 +01002623 if (active_swap_state->copy_done != BOOT_FLAG_SET) {
2624 if (active_swap_state->copy_done == BOOT_FLAG_BAD) {
David Vincze505fba22020-10-22 13:53:29 +02002625 BOOT_LOG_DBG("The copy_done flag had an unexpected value. Its "
2626 "value was neither 'set' nor 'unset', but 'bad'.");
2627 }
2628 /*
2629 * Set the copy_done flag, indicating that the image has been
2630 * selected to boot. It can be set in advance, before even
2631 * validating the image, because in case the validation fails, the
2632 * entire image slot will be erased (including the trailer).
2633 */
2634 rc = boot_write_copy_done(fap);
2635 if (rc != 0) {
2636 BOOT_LOG_WRN("Failed to set copy_done flag of the image in "
Carlos Falgueras Garcíaae13c3c2021-06-21 17:20:31 +02002637 "the %s slot.", (active_slot == BOOT_PRIMARY_SLOT) ?
David Vincze505fba22020-10-22 13:53:29 +02002638 "primary" : "secondary");
2639 rc = 0;
2640 }
2641 }
2642 flash_area_close(fap);
2643 }
2644
2645 return rc;
2646}
David Vincze1c456242021-06-29 15:25:24 +02002647#endif /* MCUBOOT_DIRECT_XIP && MCUBOOT_DIRECT_XIP_REVERT */
David Vincze505fba22020-10-22 13:53:29 +02002648
Tamas Banfe031092020-09-10 17:32:39 +02002649#ifdef MCUBOOT_RAM_LOAD
2650
Mark Horvathccaf7f82021-01-04 18:16:42 +01002651#ifndef MULTIPLE_EXECUTABLE_RAM_REGIONS
Tamas Banfe031092020-09-10 17:32:39 +02002652#if !defined(IMAGE_EXECUTABLE_RAM_START) || !defined(IMAGE_EXECUTABLE_RAM_SIZE)
2653#error "Platform MUST define executable RAM bounds in case of RAM_LOAD"
2654#endif
Mark Horvathccaf7f82021-01-04 18:16:42 +01002655#endif
Tamas Banfe031092020-09-10 17:32:39 +02002656
2657/**
Mark Horvathccaf7f82021-01-04 18:16:42 +01002658 * Verifies that the active slot of the current image can be loaded within the
2659 * predefined bounds that are allowed to be used by executable images.
Tamas Banfe031092020-09-10 17:32:39 +02002660 *
Mark Horvathccaf7f82021-01-04 18:16:42 +01002661 * @param state Boot loader status information.
Tamas Banfe031092020-09-10 17:32:39 +02002662 *
Mark Horvathccaf7f82021-01-04 18:16:42 +01002663 * @return 0 on success; nonzero on failure.
Tamas Banfe031092020-09-10 17:32:39 +02002664 */
2665static int
Raef Colesfe57e7d2021-10-15 11:07:09 +01002666boot_verify_ram_load_address(struct boot_loader_state *state)
Tamas Banfe031092020-09-10 17:32:39 +02002667{
Mark Horvathccaf7f82021-01-04 18:16:42 +01002668 uint32_t img_dst;
2669 uint32_t img_sz;
Tamas Banfe031092020-09-10 17:32:39 +02002670 uint32_t img_end_addr;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002671 uint32_t exec_ram_start;
2672 uint32_t exec_ram_size;
David Brown695e5912021-05-24 16:58:01 -06002673
2674 (void)state;
2675
Mark Horvathccaf7f82021-01-04 18:16:42 +01002676#ifdef MULTIPLE_EXECUTABLE_RAM_REGIONS
2677 int rc;
Tamas Banfe031092020-09-10 17:32:39 +02002678
Mark Horvathccaf7f82021-01-04 18:16:42 +01002679 rc = boot_get_image_exec_ram_info(BOOT_CURR_IMG(state), &exec_ram_start,
2680 &exec_ram_size);
2681 if (rc != 0) {
2682 return BOOT_EBADSTATUS;
2683 }
2684#else
2685 exec_ram_start = IMAGE_EXECUTABLE_RAM_START;
2686 exec_ram_size = IMAGE_EXECUTABLE_RAM_SIZE;
2687#endif
2688
Raef Colesfe57e7d2021-10-15 11:07:09 +01002689 img_dst = state->slot_usage[BOOT_CURR_IMG(state)].img_dst;
2690 img_sz = state->slot_usage[BOOT_CURR_IMG(state)].img_sz;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002691
2692 if (img_dst < exec_ram_start) {
Tamas Banfe031092020-09-10 17:32:39 +02002693 return BOOT_EBADIMAGE;
2694 }
2695
2696 if (!boot_u32_safe_add(&img_end_addr, img_dst, img_sz)) {
2697 return BOOT_EBADIMAGE;
2698 }
2699
Mark Horvathccaf7f82021-01-04 18:16:42 +01002700 if (img_end_addr > (exec_ram_start + exec_ram_size)) {
Tamas Banfe031092020-09-10 17:32:39 +02002701 return BOOT_EBADIMAGE;
2702 }
2703
2704 return 0;
2705}
2706
Hugo L'Hostisdb543e52021-03-09 18:00:31 +00002707#ifdef MCUBOOT_ENC_IMAGES
2708
2709/**
2710 * Copies and decrypts an image from a slot in the flash to an SRAM address.
2711 *
2712 * @param state Boot loader status information.
2713 * @param slot The flash slot of the image to be copied to SRAM.
2714 * @param hdr The image header.
2715 * @param src_sz Size of the image.
2716 * @param img_dst Pointer to the address at which the image needs to be
2717 * copied to SRAM.
2718 *
2719 * @return 0 on success; nonzero on failure.
2720 */
2721static int
2722boot_decrypt_and_copy_image_to_sram(struct boot_loader_state *state,
2723 uint32_t slot, struct image_header *hdr,
2724 uint32_t src_sz, uint32_t img_dst)
2725{
2726 /* The flow for the decryption and copy of the image is as follows :
2727 * 1. The whole image is copied to the RAM (header + payload + TLV).
2728 * 2. The encryption key is loaded from the TLV in flash.
2729 * 3. The image is then decrypted chunk by chunk in RAM (1 chunk
2730 * is 1024 bytes). Only the payload section is decrypted.
2731 * 4. The image is authenticated in RAM.
2732 */
2733 const struct flash_area *fap_src = NULL;
2734 struct boot_status bs;
2735 uint32_t blk_off;
2736 uint32_t tlv_off;
2737 uint32_t blk_sz;
2738 uint32_t bytes_copied = hdr->ih_hdr_size;
2739 uint32_t chunk_sz;
2740 uint32_t max_sz = 1024;
2741 uint16_t idx;
Hugo L'Hostisdb543e52021-03-09 18:00:31 +00002742 uint8_t * cur_dst;
2743 int area_id;
2744 int rc;
2745 uint8_t * ram_dst = (void *)(IMAGE_RAM_BASE + img_dst);
2746
Hugo L'Hostisdb543e52021-03-09 18:00:31 +00002747 area_id = flash_area_id_from_multi_image_slot(BOOT_CURR_IMG(state), slot);
2748 rc = flash_area_open(area_id, &fap_src);
2749 if (rc != 0){
2750 return BOOT_EFLASH;
2751 }
2752
2753 tlv_off = BOOT_TLV_OFF(hdr);
2754
2755 /* Copying the whole image in RAM */
2756 rc = flash_area_read(fap_src, 0, ram_dst, src_sz);
2757 if (rc != 0) {
2758 goto done;
2759 }
2760
Dominik Ermel7f9ac972024-07-12 19:21:40 +00002761 rc = boot_enc_load(BOOT_CURR_ENC(state), slot, hdr, fap_src, &bs);
Hugo L'Hostisdb543e52021-03-09 18:00:31 +00002762 if (rc < 0) {
2763 goto done;
2764 }
2765
2766 /* if rc > 0 then the key has already been loaded */
2767 if (rc == 0 && boot_enc_set_key(BOOT_CURR_ENC(state), slot, &bs)) {
2768 goto done;
2769 }
2770
2771 /* Starting at the end of the header as the header section is not encrypted */
2772 while (bytes_copied < tlv_off) { /* TLV section copied previously */
2773 if (src_sz - bytes_copied > max_sz) {
2774 chunk_sz = max_sz;
2775 } else {
2776 chunk_sz = src_sz - bytes_copied;
2777 }
2778
2779 cur_dst = ram_dst + bytes_copied;
2780 blk_sz = chunk_sz;
2781 idx = 0;
Dominik Ermeld09112a2024-07-18 16:43:57 +00002782 blk_off = ((bytes_copied) - hdr->ih_hdr_size) & 0xf;
Hugo L'Hostisdb543e52021-03-09 18:00:31 +00002783 if (bytes_copied + chunk_sz > tlv_off) {
2784 /* Going over TLV section
2785 * Part of the chunk is encrypted payload */
Hugo L'Hostisdb543e52021-03-09 18:00:31 +00002786 blk_sz = tlv_off - (bytes_copied);
Hugo L'Hostisdb543e52021-03-09 18:00:31 +00002787 }
Dominik Ermel3f112862024-07-17 14:43:05 +00002788 boot_encrypt(BOOT_CURR_ENC(state), slot,
Dominik Ermeld09112a2024-07-18 16:43:57 +00002789 (bytes_copied + idx) - hdr->ih_hdr_size, blk_sz,
2790 blk_off, cur_dst);
Hugo L'Hostisdb543e52021-03-09 18:00:31 +00002791
2792 bytes_copied += chunk_sz;
2793 }
2794 rc = 0;
2795
2796done:
2797 flash_area_close(fap_src);
2798
2799 return rc;
2800}
2801
2802#endif /* MCUBOOT_ENC_IMAGES */
Tamas Banfe031092020-09-10 17:32:39 +02002803/**
Mark Horvathccaf7f82021-01-04 18:16:42 +01002804 * Copies a slot of the current image into SRAM.
Tamas Banfe031092020-09-10 17:32:39 +02002805 *
Mark Horvathccaf7f82021-01-04 18:16:42 +01002806 * @param state Boot loader status information.
Tamas Banfe031092020-09-10 17:32:39 +02002807 * @param slot The flash slot of the image to be copied to SRAM.
2808 * @param img_dst The address at which the image needs to be copied to
2809 * SRAM.
2810 * @param img_sz The size of the image that needs to be copied to SRAM.
2811 *
2812 * @return 0 on success; nonzero on failure.
2813 */
2814static int
Mark Horvathccaf7f82021-01-04 18:16:42 +01002815boot_copy_image_to_sram(struct boot_loader_state *state, int slot,
2816 uint32_t img_dst, uint32_t img_sz)
Tamas Banfe031092020-09-10 17:32:39 +02002817{
2818 int rc;
2819 const struct flash_area *fap_src = NULL;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002820 int area_id;
Tamas Banfe031092020-09-10 17:32:39 +02002821
Mark Horvathccaf7f82021-01-04 18:16:42 +01002822#if (BOOT_IMAGE_NUMBER == 1)
2823 (void)state;
2824#endif
2825
2826 area_id = flash_area_id_from_multi_image_slot(BOOT_CURR_IMG(state), slot);
2827
2828 rc = flash_area_open(area_id, &fap_src);
Tamas Banfe031092020-09-10 17:32:39 +02002829 if (rc != 0) {
2830 return BOOT_EFLASH;
2831 }
2832
2833 /* Direct copy from flash to its new location in SRAM. */
David Brown9bd7f902021-05-26 16:31:14 -06002834 rc = flash_area_read(fap_src, 0, (void *)(IMAGE_RAM_BASE + img_dst), img_sz);
Tamas Banfe031092020-09-10 17:32:39 +02002835 if (rc != 0) {
Antonio de Angelis48547002023-04-14 09:47:09 +01002836 BOOT_LOG_INF("Error whilst copying image %d from Flash to SRAM: %d",
2837 BOOT_CURR_IMG(state), rc);
Tamas Banfe031092020-09-10 17:32:39 +02002838 }
2839
2840 flash_area_close(fap_src);
2841
2842 return rc;
2843}
2844
Mark Horvathccaf7f82021-01-04 18:16:42 +01002845#if (BOOT_IMAGE_NUMBER > 1)
Tamas Banfe031092020-09-10 17:32:39 +02002846/**
Mark Horvathccaf7f82021-01-04 18:16:42 +01002847 * Checks if two memory regions (A and B) are overlap or not.
Tamas Banfe031092020-09-10 17:32:39 +02002848 *
Mark Horvathccaf7f82021-01-04 18:16:42 +01002849 * @param start_a Start of the A region.
2850 * @param end_a End of the A region.
2851 * @param start_b Start of the B region.
2852 * @param end_b End of the B region.
Tamas Banfe031092020-09-10 17:32:39 +02002853 *
Mark Horvathccaf7f82021-01-04 18:16:42 +01002854 * @return true if there is overlap; false otherwise.
2855 */
2856static bool
2857do_regions_overlap(uint32_t start_a, uint32_t end_a,
2858 uint32_t start_b, uint32_t end_b)
2859{
2860 if (start_b > end_a) {
2861 return false;
2862 } else if (start_b >= start_a) {
2863 return true;
2864 } else if (end_b > start_a) {
2865 return true;
2866 }
2867
2868 return false;
2869}
2870
2871/**
2872 * Checks if the image we want to load to memory overlap with an already
2873 * ramloaded image.
2874 *
Raef Colesfe57e7d2021-10-15 11:07:09 +01002875 * @param state Boot loader status information.
Mark Horvathccaf7f82021-01-04 18:16:42 +01002876 *
2877 * @return 0 if there is no overlap; nonzero otherwise.
Tamas Banfe031092020-09-10 17:32:39 +02002878 */
2879static int
Raef Colesfe57e7d2021-10-15 11:07:09 +01002880boot_check_ram_load_overlapping(struct boot_loader_state *state)
Tamas Banfe031092020-09-10 17:32:39 +02002881{
Mark Horvathccaf7f82021-01-04 18:16:42 +01002882 uint32_t i;
2883
2884 uint32_t start_a;
2885 uint32_t end_a;
2886 uint32_t start_b;
2887 uint32_t end_b;
Raef Colesfe57e7d2021-10-15 11:07:09 +01002888 uint32_t image_id_to_check = BOOT_CURR_IMG(state);
Mark Horvathccaf7f82021-01-04 18:16:42 +01002889
Raef Colesfe57e7d2021-10-15 11:07:09 +01002890 start_a = state->slot_usage[image_id_to_check].img_dst;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002891 /* Safe to add here, values are already verified in
2892 * boot_verify_ram_load_address() */
Raef Colesfe57e7d2021-10-15 11:07:09 +01002893 end_a = start_a + state->slot_usage[image_id_to_check].img_sz;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002894
2895 for (i = 0; i < BOOT_IMAGE_NUMBER; i++) {
Raef Colesfe57e7d2021-10-15 11:07:09 +01002896 if (state->slot_usage[i].active_slot == NO_ACTIVE_SLOT
Mark Horvathccaf7f82021-01-04 18:16:42 +01002897 || i == image_id_to_check) {
2898 continue;
2899 }
2900
Raef Colesfe57e7d2021-10-15 11:07:09 +01002901 start_b = state->slot_usage[i].img_dst;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002902 /* Safe to add here, values are already verified in
2903 * boot_verify_ram_load_address() */
Raef Colesfe57e7d2021-10-15 11:07:09 +01002904 end_b = start_b + state->slot_usage[i].img_sz;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002905
2906 if (do_regions_overlap(start_a, end_a, start_b, end_b)) {
2907 return -1;
2908 }
2909 }
2910
2911 return 0;
2912}
2913#endif
2914
2915/**
2916 * Loads the active slot of the current image into SRAM. The load address and
2917 * image size is extracted from the image header.
2918 *
2919 * @param state Boot loader status information.
Mark Horvathccaf7f82021-01-04 18:16:42 +01002920 *
2921 * @return 0 on success; nonzero on failure.
2922 */
2923static int
Raef Colesfe57e7d2021-10-15 11:07:09 +01002924boot_load_image_to_sram(struct boot_loader_state *state)
Mark Horvathccaf7f82021-01-04 18:16:42 +01002925{
2926 uint32_t active_slot;
2927 struct image_header *hdr = NULL;
2928 uint32_t img_dst;
2929 uint32_t img_sz;
Tamas Banfe031092020-09-10 17:32:39 +02002930 int rc;
2931
Raef Colesfe57e7d2021-10-15 11:07:09 +01002932 active_slot = state->slot_usage[BOOT_CURR_IMG(state)].active_slot;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002933 hdr = boot_img_hdr(state, active_slot);
2934
Tamas Banfe031092020-09-10 17:32:39 +02002935 if (hdr->ih_flags & IMAGE_F_RAM_LOAD) {
2936
Mark Horvathccaf7f82021-01-04 18:16:42 +01002937 img_dst = hdr->ih_load_addr;
Tamas Banfe031092020-09-10 17:32:39 +02002938
Mark Horvathccaf7f82021-01-04 18:16:42 +01002939 rc = boot_read_image_size(state, active_slot, &img_sz);
Tamas Banfe031092020-09-10 17:32:39 +02002940 if (rc != 0) {
2941 return rc;
2942 }
2943
Raef Colesfe57e7d2021-10-15 11:07:09 +01002944 state->slot_usage[BOOT_CURR_IMG(state)].img_dst = img_dst;
2945 state->slot_usage[BOOT_CURR_IMG(state)].img_sz = img_sz;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002946
Raef Colesfe57e7d2021-10-15 11:07:09 +01002947 rc = boot_verify_ram_load_address(state);
Tamas Banfe031092020-09-10 17:32:39 +02002948 if (rc != 0) {
Antonio de Angelisba5fb1c2022-10-11 10:10:37 +01002949 BOOT_LOG_INF("Image %d RAM load address 0x%x is invalid.", BOOT_CURR_IMG(state), img_dst);
Tamas Banfe031092020-09-10 17:32:39 +02002950 return rc;
2951 }
2952
Mark Horvathccaf7f82021-01-04 18:16:42 +01002953#if (BOOT_IMAGE_NUMBER > 1)
Raef Colesfe57e7d2021-10-15 11:07:09 +01002954 rc = boot_check_ram_load_overlapping(state);
Mark Horvathccaf7f82021-01-04 18:16:42 +01002955 if (rc != 0) {
Antonio de Angelisba5fb1c2022-10-11 10:10:37 +01002956 BOOT_LOG_INF("Image %d RAM loading to address 0x%x would overlap with\
2957 another image.", BOOT_CURR_IMG(state), img_dst);
Mark Horvathccaf7f82021-01-04 18:16:42 +01002958 return rc;
2959 }
2960#endif
Hugo L'Hostisdb543e52021-03-09 18:00:31 +00002961#ifdef MCUBOOT_ENC_IMAGES
2962 /* decrypt image if encrypted and copy it to RAM */
2963 if (IS_ENCRYPTED(hdr)) {
2964 rc = boot_decrypt_and_copy_image_to_sram(state, active_slot, hdr, img_sz, img_dst);
2965 } else {
2966 rc = boot_copy_image_to_sram(state, active_slot, img_dst, img_sz);
2967 }
2968#else
Tamas Banfe031092020-09-10 17:32:39 +02002969 /* Copy image to the load address from where it currently resides in
2970 * flash.
2971 */
Mark Horvathccaf7f82021-01-04 18:16:42 +01002972 rc = boot_copy_image_to_sram(state, active_slot, img_dst, img_sz);
Hugo L'Hostisdb543e52021-03-09 18:00:31 +00002973#endif
Tamas Banfe031092020-09-10 17:32:39 +02002974 if (rc != 0) {
Antonio de Angelisba5fb1c2022-10-11 10:10:37 +01002975 BOOT_LOG_INF("Image %d RAM loading to 0x%x is failed.", BOOT_CURR_IMG(state), img_dst);
Tamas Banfe031092020-09-10 17:32:39 +02002976 } else {
Antonio de Angelisba5fb1c2022-10-11 10:10:37 +01002977 BOOT_LOG_INF("Image %d RAM loading to 0x%x is succeeded.", BOOT_CURR_IMG(state), img_dst);
Tamas Banfe031092020-09-10 17:32:39 +02002978 }
2979 } else {
2980 /* Only images that support IMAGE_F_RAM_LOAD are allowed if
2981 * MCUBOOT_RAM_LOAD is set.
2982 */
2983 rc = BOOT_EBADIMAGE;
2984 }
2985
Mark Horvathccaf7f82021-01-04 18:16:42 +01002986 if (rc != 0) {
Raef Colesfe57e7d2021-10-15 11:07:09 +01002987 state->slot_usage[BOOT_CURR_IMG(state)].img_dst = 0;
2988 state->slot_usage[BOOT_CURR_IMG(state)].img_sz = 0;
Mark Horvathccaf7f82021-01-04 18:16:42 +01002989 }
2990
Tamas Banfe031092020-09-10 17:32:39 +02002991 return rc;
2992}
2993
2994/**
2995 * Removes an image from SRAM, by overwriting it with zeros.
2996 *
Mark Horvathccaf7f82021-01-04 18:16:42 +01002997 * @param state Boot loader status information.
Mark Horvathccaf7f82021-01-04 18:16:42 +01002998 *
2999 * @return 0 on success; nonzero on failure.
3000 */
3001static inline int
Raef Colesfe57e7d2021-10-15 11:07:09 +01003002boot_remove_image_from_sram(struct boot_loader_state *state)
Mark Horvathccaf7f82021-01-04 18:16:42 +01003003{
David Brown695e5912021-05-24 16:58:01 -06003004 (void)state;
3005
Antonio de Angelisba5fb1c2022-10-11 10:10:37 +01003006 BOOT_LOG_INF("Removing image %d from SRAM at address 0x%x",
3007 BOOT_CURR_IMG(state),
Raef Colesfe57e7d2021-10-15 11:07:09 +01003008 state->slot_usage[BOOT_CURR_IMG(state)].img_dst);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003009
Raef Colesfe57e7d2021-10-15 11:07:09 +01003010 memset((void*)(IMAGE_RAM_BASE + state->slot_usage[BOOT_CURR_IMG(state)].img_dst),
3011 0, state->slot_usage[BOOT_CURR_IMG(state)].img_sz);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003012
Raef Colesfe57e7d2021-10-15 11:07:09 +01003013 state->slot_usage[BOOT_CURR_IMG(state)].img_dst = 0;
3014 state->slot_usage[BOOT_CURR_IMG(state)].img_sz = 0;
Mark Horvathccaf7f82021-01-04 18:16:42 +01003015
3016 return 0;
3017}
3018
3019/**
3020 * Removes an image from flash by erasing the corresponding flash area
3021 *
3022 * @param state Boot loader status information.
3023 * @param slot The flash slot of the image to be erased.
Tamas Banfe031092020-09-10 17:32:39 +02003024 *
3025 * @return 0 on success; nonzero on failure.
3026 */
3027static inline int
Mark Horvathccaf7f82021-01-04 18:16:42 +01003028boot_remove_image_from_flash(struct boot_loader_state *state, uint32_t slot)
Tamas Banfe031092020-09-10 17:32:39 +02003029{
Mark Horvathccaf7f82021-01-04 18:16:42 +01003030 int area_id;
3031 int rc;
3032 const struct flash_area *fap;
Tamas Banfe031092020-09-10 17:32:39 +02003033
David Brown695e5912021-05-24 16:58:01 -06003034 (void)state;
3035
Mark Horvathccaf7f82021-01-04 18:16:42 +01003036 BOOT_LOG_INF("Removing image %d slot %d from flash", BOOT_CURR_IMG(state),
3037 slot);
3038 area_id = flash_area_id_from_multi_image_slot(BOOT_CURR_IMG(state), slot);
3039 rc = flash_area_open(area_id, &fap);
3040 if (rc == 0) {
Dominik Ermel260ae092021-04-23 05:38:45 +00003041 flash_area_erase(fap, 0, flash_area_get_size(fap));
Dominik Ermel245de812022-09-02 13:39:23 +00003042 flash_area_close(fap);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003043 }
3044
3045 return rc;
Tamas Banfe031092020-09-10 17:32:39 +02003046}
3047#endif /* MCUBOOT_RAM_LOAD */
3048
Mark Horvathccaf7f82021-01-04 18:16:42 +01003049
3050/**
3051 * Tries to load a slot for all the images with validation.
3052 *
3053 * @param state Boot loader status information.
Mark Horvathccaf7f82021-01-04 18:16:42 +01003054 *
3055 * @return 0 on success; nonzero on failure.
3056 */
Michael Grand5047f032022-11-24 16:49:56 +01003057fih_ret
Raef Colesfe57e7d2021-10-15 11:07:09 +01003058boot_load_and_validate_images(struct boot_loader_state *state)
Mark Horvathccaf7f82021-01-04 18:16:42 +01003059{
3060 uint32_t active_slot;
3061 int rc;
Michael Grand5047f032022-11-24 16:49:56 +01003062 fih_ret fih_rc;
Mark Horvathccaf7f82021-01-04 18:16:42 +01003063
3064 /* Go over all the images and try to load one */
3065 IMAGES_ITER(BOOT_CURR_IMG(state)) {
3066 /* All slots tried until a valid image found. Breaking from this loop
3067 * means that a valid image found or already loaded. If no slot is
3068 * found the function returns with error code. */
3069 while (true) {
Mark Horvathccaf7f82021-01-04 18:16:42 +01003070 /* Go over all the slots and try to load one */
Raef Colesfe57e7d2021-10-15 11:07:09 +01003071 active_slot = state->slot_usage[BOOT_CURR_IMG(state)].active_slot;
Mark Horvathccaf7f82021-01-04 18:16:42 +01003072 if (active_slot != NO_ACTIVE_SLOT){
3073 /* A slot is already active, go to next image. */
3074 break;
David Vinczee574f2d2020-07-10 11:42:03 +02003075 }
David Vincze505fba22020-10-22 13:53:29 +02003076
Raef Colesfe57e7d2021-10-15 11:07:09 +01003077 active_slot = find_slot_with_highest_version(state);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003078 if (active_slot == NO_ACTIVE_SLOT) {
3079 BOOT_LOG_INF("No slot to load for image %d",
3080 BOOT_CURR_IMG(state));
3081 FIH_RET(FIH_FAILURE);
3082 }
3083
3084 /* Save the number of the active slot. */
Raef Colesfe57e7d2021-10-15 11:07:09 +01003085 state->slot_usage[BOOT_CURR_IMG(state)].active_slot = active_slot;
Mark Horvathccaf7f82021-01-04 18:16:42 +01003086
Raef Colesf11de642021-10-15 11:11:56 +01003087#if BOOT_IMAGE_NUMBER > 1
3088 if (state->img_mask[BOOT_CURR_IMG(state)]) {
3089 continue;
3090 }
3091#endif
3092
Mark Horvathccaf7f82021-01-04 18:16:42 +01003093#ifdef MCUBOOT_DIRECT_XIP
Raef Colesfe57e7d2021-10-15 11:07:09 +01003094 rc = boot_rom_address_check(state);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003095 if (rc != 0) {
3096 /* The image is placed in an unsuitable slot. */
Raef Colesfe57e7d2021-10-15 11:07:09 +01003097 state->slot_usage[BOOT_CURR_IMG(state)].slot_available[active_slot] = false;
3098 state->slot_usage[BOOT_CURR_IMG(state)].active_slot = NO_ACTIVE_SLOT;
Mark Horvathccaf7f82021-01-04 18:16:42 +01003099 continue;
3100 }
George Becksteind4d90f82021-05-11 02:00:00 -04003101
David Vincze505fba22020-10-22 13:53:29 +02003102#ifdef MCUBOOT_DIRECT_XIP_REVERT
Raef Colesfe57e7d2021-10-15 11:07:09 +01003103 rc = boot_select_or_erase(state);
David Vincze505fba22020-10-22 13:53:29 +02003104 if (rc != 0) {
3105 /* The selected image slot has been erased. */
Raef Colesfe57e7d2021-10-15 11:07:09 +01003106 state->slot_usage[BOOT_CURR_IMG(state)].slot_available[active_slot] = false;
3107 state->slot_usage[BOOT_CURR_IMG(state)].active_slot = NO_ACTIVE_SLOT;
David Vincze505fba22020-10-22 13:53:29 +02003108 continue;
3109 }
3110#endif /* MCUBOOT_DIRECT_XIP_REVERT */
David Vincze1c456242021-06-29 15:25:24 +02003111#endif /* MCUBOOT_DIRECT_XIP */
David Vincze505fba22020-10-22 13:53:29 +02003112
Tamas Banfe031092020-09-10 17:32:39 +02003113#ifdef MCUBOOT_RAM_LOAD
3114 /* Image is first loaded to RAM and authenticated there in order to
3115 * prevent TOCTOU attack during image copy. This could be applied
3116 * when loading images from external (untrusted) flash to internal
3117 * (trusted) RAM and image is authenticated before copying.
3118 */
Raef Colesfe57e7d2021-10-15 11:07:09 +01003119 rc = boot_load_image_to_sram(state);
Tamas Banfe031092020-09-10 17:32:39 +02003120 if (rc != 0 ) {
Mark Horvathccaf7f82021-01-04 18:16:42 +01003121 /* Image cannot be ramloaded. */
3122 boot_remove_image_from_flash(state, active_slot);
Raef Colesfe57e7d2021-10-15 11:07:09 +01003123 state->slot_usage[BOOT_CURR_IMG(state)].slot_available[active_slot] = false;
3124 state->slot_usage[BOOT_CURR_IMG(state)].active_slot = NO_ACTIVE_SLOT;
Tamas Banfe031092020-09-10 17:32:39 +02003125 continue;
Tamas Banfe031092020-09-10 17:32:39 +02003126 }
3127#endif /* MCUBOOT_RAM_LOAD */
Mark Horvathccaf7f82021-01-04 18:16:42 +01003128
3129 FIH_CALL(boot_validate_slot, fih_rc, state, active_slot, NULL);
Michael Grand5047f032022-11-24 16:49:56 +01003130 if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
Mark Horvathccaf7f82021-01-04 18:16:42 +01003131 /* Image is invalid. */
Tamas Banfe031092020-09-10 17:32:39 +02003132#ifdef MCUBOOT_RAM_LOAD
Raef Colesfe57e7d2021-10-15 11:07:09 +01003133 boot_remove_image_from_sram(state);
Tamas Banfe031092020-09-10 17:32:39 +02003134#endif /* MCUBOOT_RAM_LOAD */
Raef Colesfe57e7d2021-10-15 11:07:09 +01003135 state->slot_usage[BOOT_CURR_IMG(state)].slot_available[active_slot] = false;
3136 state->slot_usage[BOOT_CURR_IMG(state)].active_slot = NO_ACTIVE_SLOT;
Mark Horvathccaf7f82021-01-04 18:16:42 +01003137 continue;
David Vincze505fba22020-10-22 13:53:29 +02003138 }
Mark Horvathccaf7f82021-01-04 18:16:42 +01003139
3140 /* Valid image loaded from a slot, go to next image. */
3141 break;
3142 }
3143 }
3144
3145 FIH_RET(FIH_SUCCESS);
3146}
3147
3148/**
3149 * Updates the security counter for the current image.
3150 *
3151 * @param state Boot loader status information.
Mark Horvathccaf7f82021-01-04 18:16:42 +01003152 *
3153 * @return 0 on success; nonzero on failure.
3154 */
3155static int
Raef Colesfe57e7d2021-10-15 11:07:09 +01003156boot_update_hw_rollback_protection(struct boot_loader_state *state)
Mark Horvathccaf7f82021-01-04 18:16:42 +01003157{
3158#ifdef MCUBOOT_HW_ROLLBACK_PROT
3159 int rc;
3160
3161 /* Update the stored security counter with the newer (active) image's
3162 * security counter value.
3163 */
David Vincze1c456242021-06-29 15:25:24 +02003164#if defined(MCUBOOT_DIRECT_XIP) && defined(MCUBOOT_DIRECT_XIP_REVERT)
Mark Horvathccaf7f82021-01-04 18:16:42 +01003165 /* When the 'revert' mechanism is enabled in direct-xip mode, the
3166 * security counter can be increased only after reboot, if the image
3167 * has been confirmed at runtime (the image_ok flag has been set).
3168 * This way a 'revert' can be performed when it's necessary.
3169 */
Raef Colesfe57e7d2021-10-15 11:07:09 +01003170 if (state->slot_usage[BOOT_CURR_IMG(state)].swap_state.image_ok == BOOT_FLAG_SET) {
David Vincze505fba22020-10-22 13:53:29 +02003171#endif
Sherry Zhang50b06ae2021-07-09 15:22:51 +08003172 rc = boot_update_security_counter(BOOT_CURR_IMG(state),
Raef Colesfe57e7d2021-10-15 11:07:09 +01003173 state->slot_usage[BOOT_CURR_IMG(state)].active_slot,
3174 boot_img_hdr(state, state->slot_usage[BOOT_CURR_IMG(state)].active_slot));
David Vinczee574f2d2020-07-10 11:42:03 +02003175 if (rc != 0) {
Antonio de Angelisba5fb1c2022-10-11 10:10:37 +01003176 BOOT_LOG_ERR("Security counter update failed after image %d validation.", BOOT_CURR_IMG(state));
Mark Horvathccaf7f82021-01-04 18:16:42 +01003177 return rc;
David Vinczee574f2d2020-07-10 11:42:03 +02003178 }
David Vincze1c456242021-06-29 15:25:24 +02003179#if defined(MCUBOOT_DIRECT_XIP) && defined(MCUBOOT_DIRECT_XIP_REVERT)
Mark Horvathccaf7f82021-01-04 18:16:42 +01003180 }
3181#endif
David Vinczee574f2d2020-07-10 11:42:03 +02003182
Mark Horvathccaf7f82021-01-04 18:16:42 +01003183 return 0;
David Vinczee574f2d2020-07-10 11:42:03 +02003184
Mark Horvathccaf7f82021-01-04 18:16:42 +01003185#else /* MCUBOOT_HW_ROLLBACK_PROT */
3186 (void) (state);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003187 return 0;
3188#endif
3189}
3190
Michael Grand5047f032022-11-24 16:49:56 +01003191fih_ret
Mark Horvathccaf7f82021-01-04 18:16:42 +01003192context_boot_go(struct boot_loader_state *state, struct boot_rsp *rsp)
3193{
Mark Horvathccaf7f82021-01-04 18:16:42 +01003194 int rc;
Michael Grand5047f032022-11-24 16:49:56 +01003195 FIH_DECLARE(fih_rc, FIH_FAILURE);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003196
Raef Colesfe57e7d2021-10-15 11:07:09 +01003197 rc = boot_get_slot_usage(state);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003198 if (rc != 0) {
David Vinczee574f2d2020-07-10 11:42:03 +02003199 goto out;
3200 }
3201
Mark Horvathccaf7f82021-01-04 18:16:42 +01003202#if (BOOT_IMAGE_NUMBER > 1)
3203 while (true) {
3204#endif
Raef Colesfe57e7d2021-10-15 11:07:09 +01003205 FIH_CALL(boot_load_and_validate_images, fih_rc, state);
Michael Grand5047f032022-11-24 16:49:56 +01003206 if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
3207 FIH_SET(fih_rc, FIH_FAILURE);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003208 goto out;
3209 }
3210
3211#if (BOOT_IMAGE_NUMBER > 1)
Raef Colesfe57e7d2021-10-15 11:07:09 +01003212 rc = boot_verify_dependencies(state);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003213 if (rc != 0) {
3214 /* Dependency check failed for an image, it has been removed from
3215 * SRAM in case of MCUBOOT_RAM_LOAD strategy, and set to
3216 * unavailable. Try to load an image from another slot.
3217 */
3218 continue;
3219 }
3220 /* Dependency check was successful. */
3221 break;
3222 }
3223#endif
3224
3225 IMAGES_ITER(BOOT_CURR_IMG(state)) {
Raef Colesf11de642021-10-15 11:11:56 +01003226#if BOOT_IMAGE_NUMBER > 1
3227 if (state->img_mask[BOOT_CURR_IMG(state)]) {
3228 continue;
3229 }
3230#endif
Raef Colesfe57e7d2021-10-15 11:07:09 +01003231 rc = boot_update_hw_rollback_protection(state);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003232 if (rc != 0) {
Michael Grand5047f032022-11-24 16:49:56 +01003233 FIH_SET(fih_rc, FIH_FAILURE);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003234 goto out;
3235 }
3236
Jamie McCrae3016d002023-03-14 12:35:51 +00003237 rc = boot_add_shared_data(state, (uint8_t)state->slot_usage[BOOT_CURR_IMG(state)].active_slot);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003238 if (rc != 0) {
Michael Grand5047f032022-11-24 16:49:56 +01003239 FIH_SET(fih_rc, FIH_FAILURE);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003240 goto out;
3241 }
3242 }
3243
3244 /* All image loaded successfully. */
3245#ifdef MCUBOOT_HAVE_LOGGING
Raef Colesfe57e7d2021-10-15 11:07:09 +01003246 print_loaded_images(state);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003247#endif
3248
Raef Colesfe57e7d2021-10-15 11:07:09 +01003249 fill_rsp(state, rsp);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003250
David Vinczee574f2d2020-07-10 11:42:03 +02003251out:
Mark Horvathccaf7f82021-01-04 18:16:42 +01003252 close_all_flash_areas(state);
Raef Colese8fe6cf2020-05-26 13:07:40 +01003253
Michael Grand5047f032022-11-24 16:49:56 +01003254 if (rc != 0) {
3255 FIH_SET(fih_rc, FIH_FAILURE);
Mark Horvathccaf7f82021-01-04 18:16:42 +01003256 }
Raef Colese8fe6cf2020-05-26 13:07:40 +01003257
Mark Horvathccaf7f82021-01-04 18:16:42 +01003258 FIH_RET(fih_rc);
David Vinczee574f2d2020-07-10 11:42:03 +02003259}
Tamas Banfe031092020-09-10 17:32:39 +02003260#endif /* MCUBOOT_DIRECT_XIP || MCUBOOT_RAM_LOAD */
David Vinczee574f2d2020-07-10 11:42:03 +02003261
3262/**
Raef Colese8fe6cf2020-05-26 13:07:40 +01003263 * Prepares the booting process. This function moves images around in flash as
David Vinczee574f2d2020-07-10 11:42:03 +02003264 * appropriate, and tells you what address to boot from.
3265 *
3266 * @param rsp On success, indicates how booting should occur.
3267 *
Raef Colese8fe6cf2020-05-26 13:07:40 +01003268 * @return FIH_SUCCESS on success; nonzero on failure.
David Vinczee574f2d2020-07-10 11:42:03 +02003269 */
Michael Grand5047f032022-11-24 16:49:56 +01003270fih_ret
David Vinczee574f2d2020-07-10 11:42:03 +02003271boot_go(struct boot_rsp *rsp)
3272{
Michael Grand5047f032022-11-24 16:49:56 +01003273 FIH_DECLARE(fih_rc, FIH_FAILURE);
Raef Colesf11de642021-10-15 11:11:56 +01003274
3275 boot_state_clear(NULL);
3276
Raef Colese8fe6cf2020-05-26 13:07:40 +01003277 FIH_CALL(context_boot_go, fih_rc, &boot_data, rsp);
3278 FIH_RET(fih_rc);
David Vinczee574f2d2020-07-10 11:42:03 +02003279}
Raef Colesf11de642021-10-15 11:11:56 +01003280
3281/**
3282 * Prepares the booting process, considering only a single image. This function
3283 * moves images around in flash as appropriate, and tells you what address to
3284 * boot from.
3285 *
3286 * @param rsp On success, indicates how booting should occur.
3287 *
3288 * @param image_id The image ID to prepare the boot process for.
3289 *
3290 * @return FIH_SUCCESS on success; nonzero on failure.
3291 */
Michael Grand5047f032022-11-24 16:49:56 +01003292fih_ret
Raef Colesf11de642021-10-15 11:11:56 +01003293boot_go_for_image_id(struct boot_rsp *rsp, uint32_t image_id)
3294{
Michael Grand5047f032022-11-24 16:49:56 +01003295 FIH_DECLARE(fih_rc, FIH_FAILURE);
Raef Colesf11de642021-10-15 11:11:56 +01003296
3297 if (image_id >= BOOT_IMAGE_NUMBER) {
3298 FIH_RET(FIH_FAILURE);
3299 }
3300
3301#if BOOT_IMAGE_NUMBER > 1
3302 memset(&boot_data.img_mask, 1, BOOT_IMAGE_NUMBER);
3303 boot_data.img_mask[image_id] = 0;
3304#endif
3305
3306 FIH_CALL(context_boot_go, fih_rc, &boot_data, rsp);
3307 FIH_RET(fih_rc);
3308}
3309
3310/**
3311 * Clears the boot state, so that previous operations have no effect on new
3312 * ones.
3313 *
3314 * @param state The state that should be cleared. If the value
3315 * is NULL, the default bootloader state will be
3316 * cleared.
3317 */
3318void boot_state_clear(struct boot_loader_state *state)
3319{
3320 if (state != NULL) {
3321 memset(state, 0, sizeof(struct boot_loader_state));
3322 } else {
3323 memset(&boot_data, 0, sizeof(struct boot_loader_state));
3324 }
3325}